CVE-2026-18473

SQL Injection vulnerability in WP Directory Kit versions up to 1.5.4 allows an unauthenticated attacker to inject malicious SQL code.

The WP Directory Kit plugin for WordPress is vulnerable to Blind SQL Injection due to improper neutralization of special elements in SQL commands.

The WP Directory Kit plugin for WordPress up to version 1.5.0 is vulnerable to blind SQL injection. An attacker can send malicious SQL queries through improperly sanitized input parameters.

The WP Directory Kit plugin for WordPress (all versions up to and including 1.5.4) is vulnerable to blind SQL Injection via the 'order_by' parameter due to insufficient escaping of user-supplied input and lack of proper preparation of the existing SQL query. An authenticated attacker with custom-level access or higher can append additional SQL queries to existing queries, allowing extraction of sensitive information from the database.

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve usernames and email addresses of users holding the plugin's own roles.

The WP Directory Kit WordPress plugin before version 1.5.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection. On multisite, a single-site admin can read data from the entire network.

Unauthenticated SQL Injection in WP Directory Kit versions up to 1.5.4. An attacker can manipulate database queries without authentication.

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.