Description

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-09T06:19:05.773Z",
  "pubdate": "2026-08-09T06:19:05.773Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability exists in the WP Directory Kit WordPress plugin prior to version 1.5.5. The security defect arises from improper sanitization and escaping of user-supplied input before it is incorporated into database queries.\nSuccessful exploitation of this flaw allows unauthenticated remote attackers to execute arbitrary SQL commands directly against the underlying database. This capability introduces significant risk to the confidentiality, integrity, and availability of the affected WordPress installation.\nThreat actors can leverage this vulnerability to bypass authentication mechanisms, extract sensitive data such as password hashes and user records, modify application data, or potentially achieve remote code execution depending on the database configuration and server privileges.\nThe attack vector requires network access to the target WordPress site but does not necessitate any pre-existing user accounts, privileges, or interaction from authenticated users, making automated exploitation via malicious HTTP requests highly feasible.",
  "technicalDetails": "The root cause of the vulnerability stems from the direct interpolation or concatenation of unsanitized input parameters into a database query statement handled by the WP Directory Kit plugin.\nThe vulnerable component involves the handling logic for specific input parameters processed by the plugin before executing database operations via the WordPress database abstraction layer ($wpdb).\nAffected software versions include all iterations of the WP Directory Kit WordPress plugin preceding version 1.5.5.\nAuthentication and privilege requirements are entirely absent; the vulnerability is fully exploitable by unauthenticated remote threat actors over the network via standard HTTP requests.\nThe attack flow proceeds as follows: First, an attacker crafts a specialized HTTP request containing malicious SQL payload syntax within the vulnerable input parameter. Second, the WP Directory Kit plugin receives the input and fails to apply adequate sanitization, validation, or contextual escaping (such as utilizing $wpdb->prepare()). Third, the unsanitized parameter is concatenated directly into the active SQL statement string. Fourth, the database management system parses and executes the malicious query, allowing the injected SQL commands to alter the intended logic of the database operation.\nPayload behavior during successful exploitation typically involves union-based queries, boolean-based blind inferences, time-based delays, or error-based data extraction techniques. These payloads allow the attacker to query internal database tables, extract sensitive schema information, harvest administrator credentials, or manipulate application state.\nThe post-exploitation impact includes full database compromise, unauthorized data exfiltration, potential privilege escalation via credential theft, and potential execution of operating system commands if the database server is misconfigured with excessive privileges (such as administrative database roles)."
}