EUVD-2026-54880
GHSA-pjj3-mrpj-62ch
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated, network-reachable, low-complexity SQLi (AV:N/AC:L/PR:N/UI:N) yields full DB read and write (C:H/I:H); no direct availability impact, so A:N.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
AnalysisAI
SQL injection in the WP Directory Kit WordPress plugin before 1.5.5 lets unauthenticated attackers inject arbitrary SQL through an unsanitised, unescaped request parameter, exposing the entire WordPress database. Reported by WPScan and rated CVSS 9.1 (high confidentiality and integrity impact), it affects any site running the vulnerable versions. There is no public exploit identified at time of analysis, and the EPSS score is low (0.18%, 7th percentile), suggesting no observed mass exploitation yet.
Technical ContextAI
WP Directory Kit is a WordPress plugin that provides business/listing directory functionality, so it stores and queries directory entries in the site's MySQL/MariaDB database that backs WordPress. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a user-controllable parameter is concatenated into an SQL statement without proper sanitisation or escaping (i.e., not using WordPress's $wpdb->prepare() or equivalent parameterisation), so attacker input alters query structure. Because the endpoint is reachable by unauthenticated users, the vulnerable query is exposed to anyone who can reach the site.
RemediationAI
Upgrade the WP Directory Kit plugin to version 1.5.5 or later, which the vendor has released as the fix (Vendor-released patch: 1.5.5). Until the update is applied, compensating controls include placing the site behind a WAF with SQL-injection rules to filter malicious parameter values (may cause false positives on legitimate directory searches), restricting or disabling public access to the plugin's directory endpoints, or deactivating the WP Directory Kit plugin entirely if the directory feature is non-essential (removes the exposed functionality at the cost of directory availability). Review database logs and consider rotating secrets/credentials if compromise is suspected. Consult the WPScan advisory (https://wpscan.com/vulnerability/a5596bc1-5ae9-4141-b027-85a0b91ecdab/) for specifics.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today