EUVD-2026-80095
GHSA-xm4c-4mmm-pm6q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain custom-level WordPress account
-
DeliveryCraft malicious order_by parameter
-
ExploitInject blind SQL into existing query
-
ExecutionInfer database contents via responses
-
ImpactExfiltrate sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress account with 'custom-level access and above' on a site running the WP Directory Kit plugin version ≤1.5.4; the attacker exploits the 'order_by' parameter, which is insufficiently escaped and not parameterized. Limiting factors: exploitation is gated on holding a valid low-privilege account (PR:L), so it cannot be performed by fully anonymous attackers, and only sites that have installed this specific plugin are affected; being blind SQLi, data extraction is inferential (boolean/time-based) rather than direct. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-reachable, low-complexity, blind SQL injection whose primary constraint is the PR:L requirement - the attacker must already hold a 'custom-level access and above' account on the target WordPress site. Impact is confidentiality-only (C:H, I:N, A:N), consistent with a blind SQLi used to read sensitive database contents (credentials, user data, secret keys) rather than to modify or destroy data. No EPSS score, KEV listing, or POC is present in the supplied intelligence, so this is not currently confirmed as exploited or weaponized; it should be treated as a genuine but authentication-gated data-disclosure risk rather than a mass-exploitation emergency. The main risk driver is that WordPress sites frequently grant low/custom roles to many users, and a patched changeset already exists (trac 3626960), making n-day exploitation of unpatched sites plausible once the diff is public. No conflicting signals were found - the description, CWE-89, and CVSS vector are mutually consistent. |
| Exploit ScenarioDerived | An attacker who already holds a low-privilege 'custom-level' or higher account on a WordPress site running WP Directory Kit ≤1.5.4 submits a request manipulating the 'order_by' parameter, appending SQL that is executed against the site database. Because it is a blind SQLi, the attacker infers data (such as password hashes, user records, or wp_options secrets) via boolean/time-based responses. No public exploit code is identified at time of analysis, but the vendor patch changeset is available and could be reverse-engineered. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Blind SQL injection in the WP Directory Kit WordPress plugin, affecting all versions up to and including 1.5.4, lets an authenticated attacker with 'custom-level access and above' append arbitrary SQL to an existing query through the unescaped 'order_by' parameter and extract sensitive data from the site's database. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) because exploitation is network-reachable and low-complexity but gated behind a valid low-privilege account; confidentiality is the only impacted pillar, as the injection is blind and does not permit direct read-out or data modification. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is concentrated on sites that expose low-privilege accounts and run a vulnerable plugin version.
Earlier versions of this analysis (1)
Blind SQL injection in the WP Directory Kit plugin for WordPress (all versions up to and including 1.5.4) lets an authenticated user holding 'custom-level' capability or above append arbitrary SQL clauses through the plugin's 'order_by' sort parameter, allowing extraction of sensitive data from the site's database. The injection requires a valid WordPress account of sufficient privilege, is reachable over the network without user interaction, and yields a confidentiality-only impact scored at CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and the flaw is not listed as actively exploited; an upstream changeset addressing the parameter handling is referenced in the plugin's Trac repository.
RemediationAI
Update WP Directory Kit to the first release newer than 1.5.4 - the vendor changeset at https://plugins.trac.wordpress.org/changeset/3626960 records the corrective code, though the exact patched version number is not independently confirmed from the available data (Patch available per vendor advisory). Sites managed through WordPress should apply the plugin update from the official repository or vendor channel and verify the installed version afterwards. Where immediate upgrading is not possible, delete or deactivate the plugin if directory functionality is not in use, which removes the vulnerable code path entirely but also removes the feature. Because exploitation requires an account at 'custom-level access and above', review and prune user roles and remove any accounts that do not genuinely need that capability; note this is a compensating control only, since a legitimate lower-privileged user could still abuse the parameter. A web application firewall rule that rejects or sanitizes requests containing SQL metacharacters in the 'order_by' parameter can block known injection patterns, with the acknowledged trade-off of potential false positives and trivial bypass by encoding, so it should be treated as defense in depth rather than a fix. Monitoring database and web logs for anomalous or time-delayed requests to plugin endpoints can help detect exploitation attempts given the blind nature of the injection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-89 SQL injection in a WordPress plugin. WP Directory Kit builds database queries - including sorting logic driven by the 'order_by' request parameter - and passes user-supplied input into the SQL string without adequate escaping and without using prepared statements (parameterized placeholders) through the WordPress $wpdb abstraction. Because the parameter is concatenated into an already-constructed query, an attacker holding a 'custom-level' role or higher can inject additional SQL clauses or subqueries. The injection is blind: results are not reflected back to the attacker, so extraction relies on boolean- or time-based inference against the backend database, making it slower and noisier than a UNION-based injection but still capable of extracting sensitive records such as user data and plugin-stored content. The affected component is the WordPress plugin identified by the CPE cpe:2.3:a:wpdirectorykit:wp_directory_kit:*:*:*:*:*:*:*:*, i.e. the plugin's entire version lineage up to the fixed release.
Know when Wp Directory Kit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable and low-complexity, but requires a custom-level (low-privilege) authenticated account (PR:L); blind SQLi yields data disclosure only, so C:H with I:N/A:N.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WP Directory Kit plugin for WordPress is vulnerable to blind SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Wp Directory Kit
View allThe WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' pa
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers t
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9
An authentication bypass in the WP Directory Kit WordPress plugin through version 1.4.4 lets unauthenticated remote atta
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticate
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with mat
Stored cross-site scripting in the WP Directory Kit WordPress plugin before version 1.5.8 lets an authenticated user who
SQL injection in the WP Directory Kit WordPress plugin (versions through 1.5.7) lets authenticated users with page-build
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to miss
Exploit-DB