What is the CVSS score of CVE-2026-28142?

CVE-2026-28142 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Web Directory Free are affected by CVE-2026-28142?

The Web Directory Free WordPress plugin (versions ≤1.7.13) contains an unauthenticated SQL injection vulnerability allowing any internet visitor to extract sensitive data directly from your WordPress…

How to fix or mitigate CVE-2026-28142?

Within 24 hours: inventory all WordPress installations using Web Directory Free plugin version 1.7.13 or earlier; take screenshots of affected sites for forensics; query your WordPress database audit logs for suspicious queries to the plugin's tables. Within 7 days: immediately deactivate and remove the Web Directory Free plugin from all installations; if the plugin provides critical functionality, isolate affected WordPress instances from public internet access until a patch is available or alternative solutions are deployed. Within 30 days: reset all WordPress user account passwords; review database access logs and user activity logs for evidence of exploitation; consider deploying web application firewall rules to block SQL injection patterns targeting the specific plugin endpoint as a defense-in-depth measure for any remaining instances.

Web Directory Free CVE-2026-28142

EUVD-2026-57945 CRITICAL

SQL Injection (CWE-89)

2026-08-13 Patchstack

GHSA-46h5-57q5-h836

WordPress SQLi Web Directory Free Wordpress Plugin

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Unauthenticated network SQLi with low complexity yields full database read (C:H) and possible limited writes (I:L); impact stays within the DB so scope unchanged and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:59 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.

AnalysisAI

Unauthenticated SQL injection in the Web Directory Free WordPress plugin (by shamalli) through version 1.7.13 lets remote attackers inject arbitrary SQL into backend queries without any credentials or user interaction. Any unauthenticated visitor can reach the vulnerable parameter and read sensitive database contents, including WordPress user records and password hashes. No public exploit has been identified at time of analysis, but the flaw is trivially reachable (CVSS 9.3) and typical of Patchstack-reported plugin SQLi that is quickly reverse-engineered from the patch diff.

Technical ContextAI

The affected component is Web Directory Free, a WordPress plugin (CPE cpe:2.3:a:shamalli:web_directory_free) used to build categorized business/link directories on WordPress sites. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controlled input is concatenated into a SQL statement executed against the WordPress MySQL/MariaDB database instead of being passed through prepared statements or WordPress's $wpdb->prepare() sanitization layer. Because WordPress plugins share the site's single database with core tables (wp_users, wp_usermeta, wp_options), a single injectable query typically exposes the entire site's data, not just plugin data.

RemediationAI

Upgrade the Web Directory Free plugin to the first release above 1.7.13 that addresses this issue; the input data does not include an exact fix version, so confirm the patched version from the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/web-directory-free/vulnerability/wordpress-web-directory-free-plugin-1-7-13-sql-injection-vulnerability) and the plugin changelog before deploying. If an updated version is not yet available or cannot be applied immediately, deactivate and remove the plugin to eliminate exposure (side effect: the directory feature and any pages relying on it will stop working), or place a WordPress-aware WAF rule (e.g., Patchstack, Wordfence) in front of the site to block SQL-injection patterns on the plugin's request parameters (side effect: WAF rules can be bypassed by novel payloads and may cause false positives, so treat this as temporary). As additional hardening, restrict database user privileges for the WordPress account to the minimum required and monitor query logs for anomalous UNION/error-based patterns.