CVE-2026-109197 in WP Directory Kit Plugin
Summary
by MITRE • 10/31/2026
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The WP Directory Kit plugin, a widely utilized tool for creating directory listings within WordPress environments, contains a critical security flaw identified as a generic SQL injection vulnerability affecting all versions up to and including 1.6.0. This vulnerability stems directly from insufficient input validation and sanitization mechanisms applied to the idfield parameter during request processing. When an end-user interacts with the plugin by submitting data through this specific parameter, the application fails to properly escape special characters or prepare the SQL query for execution. Consequently, any user-supplied content is injected directly into the database backend without adequate safeguards, creating a direct pathway for malicious actors to manipulate the underlying database structure and queries.
From a technical perspective, the core issue lies in the lack of prepared statements or proper escaping functions typically required by secure coding standards such as OWASP guidelines for preventing SQL injection attacks. Because the idfield parameter is not sanitized before being concatenated into an existing SQL query string, attackers can append arbitrary SQL commands to the original statement. This capability allows unauthenticated remote users to bypass authentication controls and execute unintended database operations. The vulnerability aligns with CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command, highlighting a fundamental failure in input handling that compromises data integrity and confidentiality within the application layer.
The operational impact of this flaw is severe due to its unauthenticated nature, meaning no valid credentials are required to exploit it. Attackers can leverage tools like sqlmap or custom scripts to extract sensitive information stored in the WordPress database, including user passwords, email addresses, administrative privileges, and potentially site configuration details that could lead to full server compromise. Furthermore, depending on the specific database engine version and permissions granted to the web application account, an attacker might escalate this access to write files onto the server or execute system commands, effectively gaining remote code execution capabilities. This scenario maps closely to ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing injected payloads and T1213 Data from Information Repositories for exfiltrating data directly from the database without detection by standard application logs that only record legitimate queries.
To mitigate this vulnerability, immediate action is required to update the WP Directory Kit plugin to a version later than 1.6.0 where these input handling issues have been addressed by the developers through proper parameterized query implementation and strict type checking for numeric inputs like identifiers. In cases where updating is not immediately feasible due to compatibility constraints or other operational dependencies, administrators should implement web application firewall rules that detect and block common SQL injection patterns targeting the idfield parameter. Additionally, enforcing principle of least privilege on database accounts used by WordPress ensures that even if an injection occurs, the potential damage is limited to read-only access where possible, reducing the risk of data modification or system-level compromise until a permanent patch can be applied.