WP Directory Kit CVE-2026-18230

Exploitation requires any valid WordPress authenticated session at Subscriber level or higher - no special role, no admin access. The WP Directory Kit plugin must be installed, active, and running a version below 1.5.6. The vulnerable code path is an AJAX action handler reachable via WordPress's standard admin-ajax.php endpoint, which is accessible in all default WordPress deployments; no non-default server or plugin configuration is required. The primary limiting factor is authentication: the attacker must hold or obtain at least one account on the target site. Sites with open user registration (WordPress default on many installs) effectively reduce this to a near-unauthenticated condition, since registration is trivial. Sites that disable user registration and have no shared or leaked credentials are partially protected until patching occurs.

The NVD CVSS 8.1 score is well-calibrated: AV:N/AC:L/PR:L/UI:N reflects a network-exploitable, low-complexity flaw requiring only Subscriber-level access with no user interaction, which matches the technical description precisely. The EPSS of 16% is substantially above the median for WordPress plugin CVEs (typically under 1%), a signal amplified by the confirmed existence of a public POC via WPScan. The High Confidentiality and High Integrity impact (C:H/I:H) means both data exfiltration and data manipulation - including modification of WordPress user records or plugin content - are realistic outcomes. The absence of a CISA KEV listing means confirmed in-the-wild exploitation is not established at time of analysis; however, the combination of low privilege bar, public POC, and a WordPress plugin target means exploitation attempts should be anticipated. The key risk multiplier here is open user registration: any site allowing self-registration converts this from a low-privilege internal threat to a near-unauthenticated one in practice.

An attacker registers a free Subscriber account on a WordPress site running WP Directory Kit before 1.5.6 - or leverages any pre-existing authenticated session - then sends a crafted HTTP POST to admin-ajax.php with a SQL payload embedded in the vulnerable parameter. Because the AJAX handler performs no authorization check, the request executes, and the injected SQL is processed directly by the database, enabling extraction of WordPress user credentials, email addresses, or any plugin-stored data. A publicly available POC via WPScan lowers the technical barrier substantially, making automated mass-scanning plausible.