What is the CVSS score of CVE-2026-42672?

CVE-2026-42672 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of WP Directory Kit are affected by CVE-2026-42672?

A critical vulnerability in the WP Directory Kit WordPress plugin (versions ≤1.5.1) exposes any organization using this plugin to unauthorized database access and potential data theft without…

How to fix or mitigate CVE-2026-42672?

Within 24 hours: Inventory all WordPress installations for WP Directory Kit 1.5.1 or earlier; immediately disable and remove the plugin from production systems. Within 7 days: Engage database team to review transaction logs for unauthorized access patterns; deploy Web Application Firewall rules to block SQL injection exploitation attempts. Within 30 days: Monitor Patchstack and vendor advisory channels for security patch release; develop migration timeline to alternative directory solutions.

WP Directory Kit CVE-2026-42672

EUVD-2026-33691 CRITICAL

SQL Injection (CWE-89)

2026-06-01 Patchstack

GHSA-6w2j-fvqj-5fjx

SQLi Wp Directory Kit

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 17:15 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection.

This issue affects WP Directory Kit: from n/a through 1.5.1.

AnalysisAI

Blind SQL injection in the WP Directory Kit WordPress plugin (versions up to and including 1.5.1) allows remote unauthenticated attackers to inject crafted SQL fragments into backend queries, enabling extraction of database contents and limited tampering with site availability. The CVSS 9.3 score reflects network-reachable exploitation with no privileges or user interaction and a scope change into the WordPress database context; no public exploit identified at time of analysis, though Patchstack has cataloged the flaw.

Technical ContextAI

WP Directory Kit is a WordPress plugin (CPE cpe:2.3:a:wp_directory_kit:wp_directory_kit) used to build directory listings inside WordPress sites. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input is concatenated into a SQL query without parameterized binding or proper escaping via wpdb->prepare(). Because the variant is blind SQL injection, the vulnerable endpoint does not echo query results directly; attackers infer data through boolean/time-based side channels against the underlying MySQL/MariaDB database that backs WordPress.

RemediationAI

Patch available per vendor advisory: upgrade WP Directory Kit beyond 1.5.1 to the fixed release listed in the Patchstack entry at https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-5-1-sql-injection-vulnerability; the exact patched version number is not stated in the input data, so confirm against the advisory before deploying. If immediate upgrade is not possible, deactivate the WP Directory Kit plugin until patched (trade-off: directory listing pages will return 404 or blank), or front the site with a WAF such as Patchstack, Wordfence, or Cloudflare with SQLi rules tuned for the plugin's request paths (trade-off: rule bypasses are common against blind SQLi and false positives may break legitimate directory search/filter parameters). Additionally, restrict database user privileges so the WordPress DB account cannot read tables outside the WordPress schema, reducing data exposure from any future SQLi.