CVE-2026-16589 in WP Directory Kit Plugin
Summary
by MITRE • 08/08/2026
The WP Directory Kit WordPress plugin before 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/08/2026
The WP Directory Kit WordPress plugin vulnerability represents a critical security flaw that exploits insufficient input validation and sanitization mechanisms within its authenticated ajax actions. This vulnerability affects versions prior to 155 and stems from the plugin's failure to properly sanitize and escape user-supplied parameters before incorporating them into sql statements. The flaw occurs specifically within one of the plugin's authenticated ajax endpoints which lacks proper authorization checks and nonce verification mechanisms, creating an exploitable vector for authenticated attackers.
The technical implementation of this vulnerability allows any authenticated user with subscriber-level privileges to manipulate sql queries through crafted input parameters. This occurs because the plugin processes user-provided data without adequate sanitization measures, directly injecting it into sql construction without proper escaping or parameterization. The absence of authorization checks means that even low-privilege users can access these vulnerable endpoints, while the missing nonce verification eliminates protection against cross-site request forgery attacks that could otherwise prevent unauthorized exploitation.
From an operational impact perspective, this vulnerability enables authenticated sql injection attacks that can potentially compromise the entire wordpress installation and underlying database. Attackers can leverage this flaw to extract sensitive data including user credentials, plugin configurations, and other database contents. The vulnerability's accessibility through subscriber accounts makes it particularly dangerous as it requires minimal privileges to exploit, allowing for persistent access and potential privilege escalation within the wordpress environment.
The vulnerability aligns with common weakness enumeration CWE-89 which specifically addresses sql injection flaws in software applications. It also maps to attack techniques described in the mitre ATT&CK framework under T1078 valid accounts and T1213 data from information repositories, representing how attackers can leverage legitimate user credentials to access and manipulate database resources. The absence of proper input validation and authorization checks demonstrates a failure in applying basic security principles such as the principle of least privilege and defense in depth.
Mitigation strategies should focus on immediate plugin updates to version 155 or later where the vulnerability has been addressed through proper parameter sanitization and input validation. Administrators must implement additional security measures including regular security audits, monitoring for unauthorized access attempts, and ensuring that all wordpress plugins are kept current with security patches. Network-level protections such as web application firewalls can provide additional detection capabilities while role-based access controls should be reviewed to minimize the impact of compromised subscriber accounts. The vulnerability highlights the importance of implementing proper input validation mechanisms and authorization checks in all authenticated endpoints to prevent similar issues from occurring in other wordpress plugins and web applications.