CVE-2026-16588 in WP Directory Kit Plugin
Summary
by MITRE • 09/16/2026
The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The WP Directory Kit plugin for WordPress contains a critical security flaw identified as blind SQL injection within its core functionality. This vulnerability affects all versions up to and including 1.5.4, stemming directly from insufficient input validation and sanitization mechanisms applied to user-supplied data. Specifically, the issue resides in the handling of the order_by parameter, which is used to dictate how directory listings are sorted. The plugin fails to properly escape this specific variable before incorporating it into database queries, creating a direct pathway for malicious actors to manipulate backend SQL logic. This lack of preparation on existing SQL queries means that user input is treated as executable code rather than safe data, violating fundamental principles of secure coding practices required in web application development.
From an operational perspective, the exploitation of this vulnerability allows authenticated attackers with custom-level access and above to execute arbitrary SQL commands against the underlying database. Because the injection is blind, the attacker cannot directly view query results on the screen but can instead infer information by observing changes in page behavior or response times based on true or false conditions embedded in their injected payloads. This capability enables the extraction of sensitive data stored within the WordPress database, such as user credentials, personal identifiable information, and administrative configuration details. The requirement for authentication means that while the attack surface is narrower than public-facing vulnerabilities, it remains significant because low-privilege accounts can be compromised to escalate privileges or exfiltrate critical organizational data.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-89, which classifies improper neutralization of special elements used in an SQL command, commonly known as SQL injection. The attack vector corresponds to ATT&CK technique T1059, specifically subcategory Command and Scripting Interpreter, where attackers use injected commands to interact directly with the database engine. Furthermore, it relates to CWE-284 regarding improper access control, as the vulnerability allows actions that should be restricted based on user role or input validity. The blind nature of the injection also touches upon information leakage principles, although in this case, the leakage is achieved through side-channel observations rather than direct data display.
Mitigation strategies must focus immediately on updating the WP Directory Kit plugin to a version newer than 1.5.4 where these issues have been addressed by the developers. Until an update is available or if patching is not feasible due to compatibility constraints, administrators should implement strict input validation rules for any custom parameters passed through the application interface. Utilizing parameterized queries or prepared statements in future development cycles will ensure that user inputs are strictly treated as data and never executed as part of the SQL command structure. Additionally, deploying a Web Application Firewall can provide an additional layer of defense by detecting and blocking patterns associated with SQL injection attempts before they reach the vulnerable application code. Regular security audits and static analysis tools should be integrated into the development lifecycle to prevent similar oversights in input handling for other parameters within the plugin ecosystem.