WP Directory Kit CVE-2026-109197

Exploitation requires that the WP Directory Kit plugin (any version through 1.6.0) be installed and active, and that an attacker can reach a request path that passes a user-supplied 'idfield' parameter into the affected query (the directory search/slider-range field handling referenced in SLIDER_RANGE.php and the Winter_MVC database layer). Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed and default configurations are exploitable; the practical limiting factors are that the target site must run this specific plugin at a vulnerable version and expose the directory feature that invokes the parameter. Impact is limited to confidentiality (C:H, I:N, A:N) - read-only data extraction, not modification or denial of service.

Signals are moderately consistent and point to a credible but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, score 7.5) describes a network-reachable, low-complexity, unauthenticated flaw that only compromises confidentiality - consistent with the described union/stacked-query SQL injection used to read database contents. The vuln.today decision label is 'this_week' rather than 'act_now' or 'emergency', which matches the absence of a KEV listing: there is no CISA KEV entry in the input, so this is not confirmed as actively exploited. No EPSS score was provided, so exploitation probability cannot be quantified from this data. The references are the Wordfence advisory and WordPress.org plugin source lines (SLIDER_RANGE.php, database.php, helpers.php, Basic.php); these are vulnerability-location references, not a verified working exploit - no public exploit was identified at time of analysis. Net: a real, patch-this-week web vulnerability (unauthenticated data-disclosure SQLi), tempered by a product with a limited install base and no evidence of in-the-wild use. The C:H/I:N/A:N profile means the realistic worst case is sensitive-data extraction, not full site takeover, unless extracted data (e.g., credentials or nonces) is chained further.

An unauthenticated attacker sends a crafted request to a page served by WP Directory Kit, placing malicious SQL in the 'idfield' parameter, which is concatenated into an unprepared query. By appending additional SQL, the attacker extracts sensitive data such as WordPress user records, password hashes, or secret keys from the database. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N); no verified working exploit code was identified in the provided sources.