CVE-2026-18473 in WP Directory Kit Plugin
Summary
by MITRE • 08/09/2026
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/09/2026
The WP Directory Kit WordPress plugin version 1.5.4 and earlier contains a critical SQL injection vulnerability that exposes unauthenticated attackers to potential system compromise. This flaw resides in the plugin's handling of user-supplied input within database queries, creating an avenue for malicious exploitation without requiring authentication credentials. The vulnerability stems from inadequate sanitisation and escaping of parameters before their incorporation into SQL statements, fundamentally undermining the plugin's security posture.
The technical implementation of this vulnerability manifests when the plugin processes external input through specific parameters that are directly concatenated into SQL query structures. Attackers can craft malicious payloads that manipulate the database query execution flow by injecting SQL code fragments through these unsanitised inputs. The lack of proper input validation and output escaping creates a persistent injection point where attacker-controlled data can alter the intended query structure, potentially enabling data extraction, modification, or deletion operations.
The operational impact of this vulnerability extends beyond simple data exposure, as unauthenticated attackers can leverage the SQL injection to gain unauthorized access to sensitive information stored within the WordPress database. This includes user credentials, personal data, and potentially administrative access tokens that could facilitate further compromise of the affected WordPress installation. The vulnerability's accessibility to unauthenticated users significantly amplifies its threat level, as it eliminates the need for prior system access or credential compromise.
Organizations utilizing WP Directory Kit plugin versions prior to 1.5.5 should immediately implement mitigation strategies including immediate plugin updates to version 1.5.5 or later, which contain the necessary sanitisation and escaping mechanisms. Additionally, implementing proper input validation at multiple layers of the application architecture provides defense-in-depth protection against similar vulnerabilities. Database access controls should be reviewed to ensure least privilege principles are maintained, and monitoring systems should be enhanced to detect anomalous database query patterns that may indicate exploitation attempts.
This vulnerability aligns with CWE-89, which categorizes SQL injection flaws as persistent security weaknesses in software applications, and maps to ATT&CK technique T1071.004 for application layer protocol manipulation. The flaw represents a classic example of improper input validation where user-supplied data flows directly into database operations without adequate sanitization, creating a fundamental breach in the application's data integrity protections. Security teams should conduct comprehensive vulnerability assessments across their WordPress environments to identify similar patterns and ensure all plugins maintain proper security hygiene through regular updates and input validation practices.