CVE-2026-16593
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The WP Directory Kit WordPress plugin through version 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement. This allows authenticated users with access to the page builder (Editor role and above) to perform SQL injection attacks that execute when the affected page is rendered.
Risk Assessment
A user with Editor-level access can inject malicious SQL and gain access to data in the WordPress database, potentially including other users' or administrative data. This may lead to data leakage or modification of site data.
Recommendation
Update the WP Directory Kit plugin to a version newer than 1.5.7 as soon as a fix is available, and limit the number of users with Editor role and above to the necessary minimum.
Other vulnerabilities in WP Directory Kit WordPress plugin
See all- CVE-2026-16592Low
The WP Directory Kit WordPress plugin through version 1.5.7 does not check authorization or listing visibility in one of its shortcodes. This allows users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
- CVE-2026-16595Medium
The WP Directory Kit WordPress plugin before version 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
- CVE-2026-16594High
The WP Directory Kit WordPress plugin before version 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the plugin settings including sensitive API keys and secrets.
- CVE-2026-16590Medium
The WP Directory Kit WordPress plugin before version 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.
- CVE-2026-16589High
The WP Directory Kit WordPress plugin before version 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks. This allows any authenticated user such as a Subscriber to perform SQL injection attacks.
Original NVD description (English source)
The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS