EUVD-2026-57941
GHSA-qgc9-3hm8-36pf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) yields high confidentiality via data extraction and low integrity from possible writes; scope kept unchanged as impact stays within the WordPress DB context.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
AnalysisAI
SQL injection in the WP Directory Kit WordPress plugin (versions 1.5.4 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through unsanitized input, per a Patchstack disclosure carrying a 9.3 CVSS. Because no login is required (PR:N) and the CVSS marks a scope change with high confidentiality impact, an attacker can read sensitive database contents such as user credentials and WordPress secrets. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only that a reachable WordPress site have the WP Directory Kit plugin (version <= 1.5.4) installed and active, exposing the vulnerable directory query parameter to unauthenticated HTTP requests - no valid account, no user interaction, and no non-default configuration are indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are consistent for an internet-facing, easily exploitable web flaw: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates a network-reachable, low-complexity attack requiring no authentication or user interaction, and CWE-89 SQLi is a well-understood, frequently automated class. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WP Directory Kit to the first release after 1.5.4 that contains the fix as published by the vendor; the input data does not name an exact fixed version, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-5-4-sql-injection-vulnerability-2) and the plugin changelog to confirm the patched build before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately disable or uninstall WP Directory Kit from production environments; if removal is not feasible, implement a Web Application Firewall rule blocking requests to vulnerable endpoints and restrict access to administrator IP ranges only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Directory Kit
View allThe WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' pa
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers t
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticate
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with mat
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to miss
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a m
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today