CVE-2026-18230 in WP Directory Kit Plugin
Summary
by MITRE • 08/12/2026
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The WP Directory Kit WordPress plugin vulnerability represents a critical security flaw that exploits insufficient input validation and authorization mechanisms within a widely used content management system component. This vulnerability exists in versions prior to 1.5.6 and specifically targets the plugin's authenticated AJAX actions, which are designed to handle dynamic user interactions without proper sanitization of user-supplied data. The flaw allows any authenticated user account, including low-privilege subscribers, to execute malicious SQL commands against the underlying database through carefully crafted parameter inputs.
The technical implementation of this vulnerability stems from improper handling of user input within the plugin's backend processes. When an authenticated user accesses certain AJAX endpoints, the plugin fails to properly sanitize and escape parameters before incorporating them into SQL queries. This lack of input sanitization creates a classic SQL injection vector where malicious payloads can be executed with the privileges of the affected WordPress installation. The absence of authorization checks further compounds the issue by removing any barriers that would normally prevent unauthorized access to administrative functions, effectively removing the need for additional privilege escalation.
The operational impact of this vulnerability extends beyond simple data theft, as it enables attackers to manipulate or extract sensitive information from the WordPress database. An authenticated subscriber could potentially access user credentials, personal information, plugin configurations, and other database contents that should remain protected. The vulnerability's exploitation requires minimal privileges compared to traditional SQL injection attacks, making it particularly dangerous in environments where user accounts are not properly secured or where multiple users have access to the system. This scenario creates a significant risk for organizations relying on WordPress for business operations, as compromised subscriber accounts can quickly escalate into full database compromise.
The vulnerability aligns with CWE-89 which specifically addresses SQL injection flaws and corresponds to ATT&CK technique T1078 004 related to valid accounts for lateral movement. Organizations should immediately update to WP Directory Kit version 1.5.6 or later to remediate this issue, as no effective workarounds exist for this particular flaw. Additional mitigations include implementing strict access controls, monitoring for unusual AJAX activity patterns, and regularly reviewing user permissions to minimize the attack surface. Security teams should also consider deploying web application firewalls and database activity monitoring solutions to detect potential exploitation attempts while the patch is being deployed across all affected systems.
The broader implications of this vulnerability highlight the importance of proper input validation and authorization checks in WordPress plugin development. This flaw demonstrates how seemingly minor security oversights in plugin code can create significant risks for entire WordPress installations, particularly when plugins handle authenticated user interactions with database operations. Organizations should conduct thorough security assessments of their WordPress environments to identify similar vulnerabilities in other plugins and themes, ensuring comprehensive protection against exploitation vectors that target the WordPress ecosystem's most commonly used components.