Description

The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-15T06:16:57.370Z",
  "pubdate": "2026-09-15T06:16:57.370Z",
  "executiveSummary": "The WP Directory Kit WordPress plugin, in versions up to and including 1.5.7, is susceptible to an authenticated SQL injection vulnerability.\nThis vulnerability exists because the plugin fails to properly sanitize and escape specific widget settings before incorporating them into database queries.\nThe flaw can be exploited by authenticated users with Editor-level privileges or higher who have access to the page builder functionality.\nBy injecting malicious SQL commands into widget configuration fields, an attacker can manipulate the plugin's interaction with the WordPress database.\nSuccessful exploitation allows for unauthorized data extraction, modification, or deletion, depending on the database user permissions.\nThe vulnerability manifests when the page containing the malicious widget configuration is rendered, triggering the execution of the injected SQL statement.\nThe primary risk implications include potential compromise of sensitive site information and unauthorized administrative actions within the database environment.\nGiven the requirement for Editor-level privileges, this vulnerability is classified as a privilege-dependent threat rather than an unauthenticated entry point.",
  "technicalDetails": "The vulnerability resides within the internal handling of widget configuration data in WP Directory Kit versions through 1.5.7. The plugin processes user-supplied data from widget settings and fails to implement adequate input validation or parameterization before embedding these values directly into SQL statements executed against the WordPress database.\nThe root cause is identified as improper sanitization and escaping protocols within the plugin's backend logic when retrieving and parsing user-defined widget parameters. Because the plugin does not enforce strict data typing or utilize prepared statements for these specific database interactions, the application becomes susceptible to arbitrary SQL injection.\nAttackers with access to the page builder interface—specifically those with Editor or Administrator roles—can manipulate widget attributes to include crafted SQL payloads. When the page associated with the compromised widget is rendered (either by the attacker or by another site user viewing the page), the application backend parses the configuration settings and executes the injected SQL query.\nThe attack flow follows a structured path: First, the attacker navigates to the page builder interface to select an affected WP Directory Kit widget. Second, the attacker inserts a malicious SQL payload into one of the available widget settings fields that is processed server-side. Third, the attacker saves the configuration. Finally, the malicious payload is executed by the database engine when the plugin logic retrieves the configuration data to render the widget on the frontend.\nThe impact of a successful exploitation includes, but is not limited to, the exposure of hashed administrative credentials, unauthorized access to sensitive user metadata, or modification of application data. Since the queries are executed within the application's context, the database user's privileges define the upper bound of the impact, potentially leading to full database compromise or secondary attacks via data manipulation. The vulnerability is persistent, as the malicious payload remains stored within the WordPress database until manually removed or until the plugin is patched to sanitize the input correctly."
}