CVE-2026-18653
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The WP Directory Kit WordPress plugin before version 1.5.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection. On multisite, a single-site admin can read data from the entire network.
Risk Assessment
The risk includes data theft across the multisite network, compromising database confidentiality and integrity.
Recommendation
Update the plugin to version 1.5.7 or later and restrict subsite admin privileges in multisite environments.
Original NVD description (English source)
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire network, which they are not otherwise able to reach.