Description

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-12T06:20:14.283Z",
  "pubdate": "2026-08-12T06:20:14.283Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability exists in the WP Directory Kit WordPress plugin prior to version 1.5.6. The flaw arises from insufficient sanitization and escaping of user-supplied input parameters before they are dynamically concatenated into a database query. This security deficiency allows remote, unauthenticated attackers to manipulate SQL statements executed against the underlying database.\nThe successful exploitation of this vulnerability can lead to unauthorized access to sensitive database contents, including application data, user credentials, and administrative records. Depending on the database privileges associated with the web application, an attacker could potentially execute arbitrary database commands, escalate privileges, or compromise the integrity and availability of the entire WordPress installation.\nThe risk implication is critical, as exploitation requires no prior authentication or specialized privileges within the target system. However, specific exploitation conditions dictate that a non-default search field type must be configured within the plugin to expose the vulnerable code path. Immediate remediation is required to mitigate potential exposure and prevent automated or targeted database exploitation attempts.",
  "technicalDetails": "The root cause of the vulnerability resides within the input handling and database query construction mechanisms of the WP Directory Kit plugin prior to version 1.5.6. Specifically, the affected component fails to enforce proper input validation, sanitization, and context-aware escaping on a user-controlled parameter prior to its inclusion in a database query execution routine.\nWhen a non-default search field type is configured within the plugin's operational parameters, user input submitted via HTTP requests is directly processed and interpolated into a SQL statement. Because the parameter lacks adequate parameterization or secure abstraction layer handling, malicious input containing SQL syntax characters is interpreted as executable database commands by the database management system.\nThe attack flow proceeds as follows: First, an unauthenticated remote attacker identifies a vulnerable endpoint within the plugin associated with search functionality where a non-default search field type is active. Second, the attacker crafts a specialized HTTP request containing a malicious SQL injection payload injected into the vulnerable parameter. Third, the plugin incorporates this unescaped input directly into the database query structure. Finally, the database executes the resulting malformed query, returning unauthorized data sets or performing unintended database modifications depending on the constructed payload structure.\nThe vulnerability is exposed over the network via standard HTTP/HTTPS protocols targeting the WordPress site hosting the vulnerable plugin. Exploitation can be automated using standard web vulnerability scanners or specialized SQL injection exploitation frameworks. Because the vector is accessible to unauthenticated actors, no valid user session, cookies, or role-based privileges are required to initiate the attack sequence against the affected component across all versions prior to 1.5.6."
}