WP Directory Kit CVE-2026-18653

Exploitation requires a valid WordPress administrator account - either a network super admin or a single-site administrator. On a standard single-site WordPress installation, the attacker must already hold administrator-level credentials, and the incremental data access gained is limited since admins typically already have broad database visibility. The high-severity scenario is specific to WordPress multisite network deployments, where the shared database architecture enables cross-site data access. The WP Directory Kit plugin must be installed and activated on the target site. SSVC rates Automatable as 'no', meaning exploitation requires an authenticated session and cannot be scripted for mass targeting. Factors limiting exploitation: PR:H requires a compromised or malicious admin account; non-multisite installations face minimal incremental risk; UI:N means no victim interaction is needed once credentials are obtained.

The official CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects high-privilege-required network exploitation with full C/I/A impact. In practice, risk is highly context-dependent. On a standard single-site WordPress installation, this is a privilege-abuse scenario: administrators already have broad database access, so the incremental attacker value is limited. On a WordPress multisite network, the risk escalates significantly - a malicious or compromised single-site admin can exfiltrate credentials, PII, or proprietary content from sibling sites they have no legitimate access to, representing a genuine authorization boundary violation. SSVC rates Technical Impact as 'total' and Automatable as 'no', confirming high damage potential if targeted but no mass exploitation pathway. EPSS at 0.17% aligns with SSVC's non-automatable rating. A public PoC from WPScan lowers the technical bar for a targeted attacker. Security teams should prioritize patching on multisite deployments over single-site installations.

An attacker who has obtained or holds WordPress administrator credentials for a single site in a multisite network authenticates to the WP Directory Kit admin panel and submits a crafted request containing a SQL injection payload in the vulnerable parameter. The unsanitized input is executed against the shared network database, allowing the attacker to enumerate and dump tables from other sites on the network - extracting user credentials, email addresses, or other sensitive data that their site-admin role does not authorize them to access. A public PoC is available via WPScan, reducing the technical skill required for this step.