CVE-2026-16588
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The WP Directory Kit plugin for WordPress (all versions up to and including 1.5.4) is vulnerable to blind SQL Injection via the 'order_by' parameter due to insufficient escaping of user-supplied input and lack of proper preparation of the existing SQL query. An authenticated attacker with custom-level access or higher can append additional SQL queries to existing queries, allowing extraction of sensitive information from the database.
Risk Assessment
Blind SQL injection can enable an attacker to extract sensitive data from the database, such as user data or configuration. This can lead to confidentiality breaches and further attacks.
Recommendation
Update the WP Directory Kit plugin to a version newer than 1.5.4 that contains the fix for this vulnerability.
Other vulnerabilities in WP Directory Kit
See all- CVE-2026-28001Critical
SQL Injection vulnerability in WP Directory Kit versions up to 1.5.4 allows an unauthenticated attacker to inject malicious SQL code.
- CVE-2026-18473Critical
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- CVE-2026-42672Critical
The WP Directory Kit plugin for WordPress is vulnerable to Blind SQL Injection due to improper neutralization of special elements in SQL commands.
- CVE-2026-39531Critical
The WP Directory Kit plugin for WordPress up to version 1.5.0 is vulnerable to blind SQL injection. An attacker can send malicious SQL queries through improperly sanitized input parameters.
- CVE-2026-18232Medium
The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.
- CVE-2026-18231Medium
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve usernames and email addresses of users holding the plugin's own roles.
- CVE-2026-18653High
The WP Directory Kit WordPress plugin before version 1.5.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection. On multisite, a single-site admin can read data from the entire network.
- CVE-2026-27538High
Unauthenticated SQL Injection in WP Directory Kit versions up to 1.5.4. An attacker can manipulate database queries without authentication.
- CVE-2026-18474High
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.
- CVE-2026-18230High
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
Original NVD description (English source)
The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.