WP Directory Kit CVE-2026-96653

Exploitation requires (1) an authenticated account with subscriber-level access or above - practically, the site must permit user registration or the attacker must otherwise obtain a low-privilege account; and (2) the WP Directory Kit plugin installed and active at version 1.5.9 or earlier. The specific trigger is editing the user profile's 'display_name' field with a single-quote-based payload, which is stored verbatim by WordPress and only fires later when WdkCachedUserEditor::update_listings_user_editor() re-reads the cached value into the SQL query (second-order). Limiting factors: this is blind/time-based, so extraction is slow and generates measurable request volume; no code execution, data modification, or denial of service results (C:H/I:N/A:N); and sites that disable open registration or restrict profile editing significantly raise the bar.

This is a genuine but moderate-priority vulnerability, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent with the description: network-reachable, low-complexity, requiring low privileges (PR:L corresponds to the stated subscriber-level authenticated access), with high confidentiality impact (database extraction) and no integrity or availability impact. The authentication requirement (PR:L) is the single biggest risk-limiter - an attacker must be able to register or already hold a subscriber account, so sites that disable open registration materially reduce exposure. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation probability signals are simply absent rather than conflicting. The second-order, time-based blind nature means data exfiltration is slow and noisy (character-by-character inference), which further reduces practical mass-exploitation appeal compared to in-band SQLi. Net: a real, patch-worthy confidentiality flaw on affected sites that allow subscriber registration, but the low-privilege gate, blind time-based extraction mechanics, and absence of any exploitation/POC signal place it below critical internet-facing unauthenticated issues in triage order.

An attacker registers a subscriber account on a WordPress site running WP Directory Kit <=1.5.9, then edits their own profile to store a display_name containing SQL injection syntax (e.g., a single quote plus a time-based payload). When WdkCachedUserEditor::update_listings_user_editor() later re-reads that stored display_name and concatenates it into a query, the payload executes, letting the attacker infer sensitive database contents (user credentials, secrets) via response-timing oracles. No public exploit code was identified at time of analysis; exploitation requires only subscriber-level authentication and no victim interaction.