CVE-2026-109197

The WP Directory Kit plugin for WordPress up to version 1.5.4 is vulnerable to generic SQL Injection via the 'data_fields_list' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with custom-level access or higher to append additional SQL queries, potentially extracting sensitive information from the database.

SQL Injection vulnerability in WP Directory Kit versions up to 1.5.4 allows an unauthenticated attacker to inject malicious SQL code.

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

The WP Directory Kit plugin for WordPress is vulnerable to Blind SQL Injection due to improper neutralization of special elements in SQL commands.

The WP Directory Kit plugin for WordPress up to version 1.5.0 is vulnerable to blind SQL injection. An attacker can send malicious SQL queries through improperly sanitized input parameters.

The WP Directory Kit plugin for WordPress in all versions up to and including 1.4.4 is vulnerable to authentication bypass due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. The token generation mechanism is cryptographically weak, allowing unauthenticated attackers to predict the token and gain administrative access.

The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via the 'display_name' Profile Field (Second-Order) in all versions up to and including 1.5.9 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query.

The WP Directory Kit plugin for WordPress (all versions up to and including 1.5.4) is vulnerable to blind SQL Injection via the 'order_by' parameter due to insufficient escaping of user-supplied input and lack of proper preparation of the existing SQL query. An authenticated attacker with custom-level access or higher can append additional SQL queries to existing queries, allowing extraction of sensitive information from the database.

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve usernames and email addresses of users holding the plugin's own roles.