Description

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T14:16:56.510Z",
  "pubdate": "2026-08-13T14:16:56.510Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability exists in the WP Directory Kit plugin for WordPress, specifically affecting versions 1.5.4 and prior. This security flaw enables remote, unauthenticated threat actors to manipulate database queries by injecting arbitrary SQL commands through vulnerable parameters within the application. Successful exploitation of this vulnerability allows unauthorized attackers to bypass security controls, extract sensitive database contents—including user credentials and application data—modify or delete existing records, and potentially achieve remote code execution or complete compromise of the underlying WordPress installation. The risk implications are severe due to the lack of authentication requirements, allowing automated scanners and malicious actors to execute attacks over the network with minimal friction. Remediation requires updating the affected software to a patched version once available or applying strict input sanitization and parameterized queries to neutralize the attack vector.",
  "technicalDetails": "The vulnerability resides in the input handling mechanisms of the WP Directory Kit plugin for WordPress in versions 1.5.4 and below. The root cause of the issue stems from insufficient input validation and a lack of proper sanitization or parameterized preparation of user-supplied data before it is concatenated directly into database queries executed via the WordPress database abstraction layer ($wpdb). Because the vulnerable endpoints are exposed without requiring authentication or specific user privileges, any remote network attacker can send specially crafted HTTP requests containing malicious SQL payloads.\nThe attack flow proceeds as follows: First, the attacker identifies a vulnerable parameter exposed by the WP Directory Kit plugin that interfaces directly with database operations. Second, the attacker crafts an HTTP request containing malicious SQL syntax designed to manipulate the logical structure of the original query, such as utilizing UNION-based operators, boolean-based blind conditions, or time-based delays to extract data or infer database contents. Third, the plugin processes the incoming request and passes the tainted input directly into the database query execution function without proper escaping or structural separation of code and data. Fourth, the database management system executes the resulting malicious query, returning sensitive information in the application response or altering database state based on the injected instructions.\nPost-exploitation impact includes unauthorized read and write access to the entire WordPress database. Attackers can harvest sensitive data such as password hashes, session tokens, and personally identifiable information. Furthermore, depending on database permissions and underlying server configurations, advanced exploitation techniques may allow attackers to write malicious files to the filesystem or escalate privileges within the WordPress environment, leading to full system takeover."
}