EUVD-2026-57101
GHSA-5435-q9p7-mwhc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Non-default plugin configuration required to trigger the vulnerable code path raises AC to H; no authentication or user interaction needed; only confidentiality impacted per description.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.
Articles & Coverage 1
AnalysisAI
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers to read arbitrary data from the WordPress database, including user credentials and sensitive site content. The flaw was reported by WPScan, a public proof-of-concept exploit is available, and exploitation requires no authentication - though it is conditioned on a non-default search field type being configured in the plugin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be satisfied for exploitation: (1) WP Directory Kit plugin version prior to 1.5.6 must be installed and active on a WordPress site, and (2) a non-default search field type must be explicitly configured in the plugin's admin settings - sites running the default search field configuration are NOT vulnerable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects high-severity unauthenticated remote exploitation with confidentiality impact across database scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker scans the internet for WordPress installations exposing WP Directory Kit plugin assets, then probes directory search endpoints to identify sites with the non-default search field type active - detectable via distinct HTML form elements or parameter names. Using the publicly available WPScan proof-of-concept, the attacker submits a crafted unauthenticated HTTP request containing a SQL injection payload in the vulnerable search parameter. … |
| Remediation | Update WP Directory Kit to version 1.5.6 or later, which contains the vendor fix for missing input sanitization and escaping, per the WPScan advisory (https://wpscan.com/vulnerability/cadb99e3-bb6a-4d44-8ef0-eff524d31b29/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations using WP Directory Kit and verify which sites have enabled non-default search field type configurations to identify the exposed population. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Directory Kit
View allThe WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' pa
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticate
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with mat
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to miss
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a m
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today