Description

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T06:20:07.317Z",
  "pubdate": "2026-08-12T06:20:07.317Z",
  "executiveSummary": "An authenticated SQL Injection vulnerability exists in the WP Directory Kit WordPress plugin before version 1.5.6. The vulnerability arises from improper sanitization and escaping of a user-supplied parameter utilized within an SQL statement processed via an authenticated AJAX action. This endpoint lacks proper authorization checks, enabling any authenticated user, including low-privileged roles such as Subscribers, to execute arbitrary SQL queries against the underlying database.\nThe risk implication of this vulnerability is severe, as successful exploitation may lead to unauthorized database access, data exfiltration, modification or deletion of sensitive information, and potentially remote code execution or complete site compromise depending on database user privileges and server configuration. Attackers require standard authentication to a WordPress account with minimal privileges, such as a Subscriber role, to interact with the vulnerable AJAX action. No complex preconditions are necessary beyond network access to the target WordPress installation and valid low-privileged credentials.",
  "technicalDetails": "The vulnerability is rooted in the insecure handling of input parameters within the AJAX request handlers of the WP Directory Kit plugin prior to version 1.5.6. Specifically, the affected AJAX action fails to implement adequate authorization checks, allowing any authenticated user to invoke the functionality regardless of their assigned user role or capability set. Furthermore, the input parameter supplied through the request is directly concatenated or improperly bound into an SQL statement without prior sanitization, type casting, or proper escaping using secure database abstraction methods.\nThe attack flow proceeds as follows. First, an authenticated attacker with low privileges, such as a Subscriber, crafts an HTTP POST request targeted at the WordPress AJAX endpoint (admin-ajax.php) corresponding to the vulnerable WP Directory Kit action. Second, the attacker injects malicious SQL payloads into the vulnerable parameter. Third, because the plugin lacks authorization checks, the AJAX handler processes the request without verifying if the user possesses the administrative or appropriate capabilities to execute the action. Fourth, the insecure backend function passes the unsanitized parameter directly into the database query execution layer. Finally, the database interprets the malicious payload as part of the SQL command, allowing the attacker to manipulate the query logic, extract arbitrary database contents via techniques such as UNION-based SQL injection, or perform blind data inference.\nThe vulnerable component is the AJAX action handler within the WP Directory Kit plugin. All versions prior to 1.5.6 are affected. The vulnerability requires network exposure via the standard WordPress administrative AJAX interface and demands low-privileged authentication (Subscriber level). Post-exploitation impact includes unauthorized read and write access to the WordPress database tables, potential exposure of sensitive user credentials, session tokens, and plugin-specific data, and an increased risk of full administrative takeover."
}