Description

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-13T14:16:57.177Z",
  "pubdate": "2026-08-13T14:16:57.177Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability exists in the WP Directory Kit plugin for WordPress, specifically affecting versions 1.5.4 and below. This security flaw allows remote, unauthenticated attackers to manipulate SQL queries executed against the underlying database, leading to potential unauthorized access, data exfiltration, and database compromise.\nThe vulnerability arises from improper neutralization of user-supplied input before it is incorporated into database queries within the affected product. Because the flaw can be exploited without authentication over the network, the risk implications are severe, granting malicious actors the capability to read sensitive data stored in the WordPress database, including user credentials, configuration settings, and application data.\nExploitation requires no prior privileges or interaction from a privileged user, lowering the barrier to entry for potential attackers. Remediation requires updating the WP Directory Kit plugin to a patched version beyond 1.5.4 or applying vendor-supplied security patches to neutralize the injection vector and secure database interaction handlers.",
  "technicalDetails": "The vulnerability is classified as an SQL Injection (SQLI) residing within the input handling mechanisms of the WP Directory Kit plugin for WordPress, impacting all versions up to and including 1.5.4. The root cause of the flaw stems from the failure of the application to properly sanitize, validate, or parameterize user-supplied parameters before passing them directly into database query construction functions.\nThe vulnerable component processes HTTP requests containing parameters that are subsequently appended to SQL statements without adequate escaping or the use of prepared statements. Network exposure is direct, as the entry points for the vulnerable parameters are publicly accessible over HTTP/HTTPS protocols without requiring any authentication mechanism or session validation.\nThe attack flow proceeds as follows: an unauthenticated remote attacker crafts a specialized HTTP request containing malicious SQL payload data targeting the vulnerable endpoints of the WP Directory Kit plugin. Upon receipt, the application insecurely concatenates the malicious input into an active SQL query structure. The database management system subsequently parses and executes the manipulated query, interpreting the attacker-supplied SQL commands alongside the intended application logic.\nPost-exploitation impact includes the potential retrieval of sensitive database contents via techniques such as union-based SQL injection, error-based information disclosure, or blind inference methods. Attackers may extract administrative password hashes, session tokens, user metadata, and other confidential records stored within the WordPress database tables, ultimately threatening the confidentiality, integrity, and availability of the entire web application ecosystem."
}