Description

The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire network, which they are not otherwise able to reach.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-16T06:16:51.927Z",
  "pubdate": "2026-08-16T06:16:51.927Z",
  "executiveSummary": "An SQL injection vulnerability exists within the WP Directory Kit WordPress plugin, specifically affecting versions prior to 1.5.7. The flaw arises from inadequate input sanitization and output escaping of a parameter before it is dynamically concatenated into an SQL statement executed by the underlying database management system.\nThe primary impact of this security deficiency is the unauthorized extraction of sensitive database contents. In the context of a WordPress multisite installation, this vulnerability escalates the capabilities of a rogue or compromised single-site administrator, granting them unauthorized read access to data belonging to the entire network—information which they are strictly prohibited from accessing under standard multi-tenant privilege boundaries.\nExploitation requires administrative privileges within a child site of a WordPress multisite environment, meaning the attacker must already possess authenticated access at the administrator level. No complex interaction or external user assistance is typically required to trigger the database query once the privileged payload is formulated. Consequently, the risk implication involves a severe breach of data confidentiality across the multisite network, potentially exposing cross-site administrative data, user credentials, and proprietary configurations stored within the shared database schema.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure handling of user-supplied input within the WP Directory Kit plugin prior to version 1.5.7. When processing requests, the plugin accepts a specific parameter and embeds it directly into an SQL query string without applying proper sanitization routines or employing parameterized prepared statements. This architectural failure allows malicious SQL syntax to alter the intended logic of the database query.\nThe vulnerable component consists of the backend request handling and database interaction logic within the WP Directory Kit plugin. Because the affected software fails to validate or escape the input parameter, an attacker capable of issuing administrative-level requests can manipulate the query structure. The attack flow begins when the authenticated user crafts an HTTP request containing a malicious SQL payload injected into the vulnerable parameter. Upon submission, the plugin passes this unescaped string directly to the database abstraction layer, executing the modified SQL statement.\nIn a WordPress multisite installation, database tables for individual sites often share a common database with prefixed table names, or leverage shared network tables for user meta and network configurations. By exploiting this SQL injection vulnerability, an authenticated administrator of a single child site can leverage UNION-based SQL injection techniques or boolean-based blind methodologies to query tables outside their permitted scope. The payload behavior involves extracting unauthorized records, such as global user credentials, options, and data from other subsites residing in the shared database. The post-exploitation impact is characterized by a complete compromise of data confidentiality across the entire multisite network, subverting the core security isolation model of WordPress multisite architectures."
}