Arbitrary File Deletion in Listdom WordPress Plugin

Executive Summary

This vulnerability is in the Listdom WordPress plugin. It allows authenticated attackers with administrator access to delete arbitrary files on the server due to insufficient file path validation in the LSD_Menus_IX_CSV::import function. This flaw can lead to remote code execution if critical files like wp-config.php are deleted.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized file deletions in WordPress installations using the Listdom plugin. Review server logs for suspicious activity related to the LSD_Menus_IX_CSV::import function. Inspect file system changes, especially deletions of critical files like wp-config.php.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete important files on your WordPress server, potentially causing site downtime, data loss, or enabling further attacks like remote code execution. Only users with administrator access can exploit this, but it poses a serious risk to site integrity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file deletion, potentially exposing sensitive data or disrupting compliance-related operations. If exploited, it may violate GDPR (data integrity) or HIPAA (security of health data) by compromising system integrity or confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Listdom plugin to the latest version beyond 6.1.2. Remove administrator-level access for unnecessary users. Monitor file system changes and restrict write permissions to sensitive directories. Consider disabling the CSV import feature if not required.

Useful 0 Not Useful 0