CVE Catalog
CVE-2026-28142
CriticalCVSS 9.3Summary
Unauthenticated SQL Injection vulnerability in Web Directory Free versions up to 1.7.13. An attacker can execute arbitrary SQL queries without authentication.
Risk Assessment
Risk includes unauthorized access to the database, potentially leading to data leakage, modification, or deletion.
Recommendation
Update the plugin to the latest patched version. Restrict access to the admin panel and monitor logs for suspicious queries.
Original NVD description (English source)
Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.