What is the CVSS score of EUVD-2026-57936?

EUVD-2026-57936 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of WP Directory Kit are affected by EUVD-2026-57936?

WP Directory Kit versions 1.5.4 and earlier contain a SQL injection vulnerability allowing unauthenticated remote attackers to extract WordPress database contents, including administrator credentials…

How to fix or mitigate EUVD-2026-57936?

Within 24 hours, inventory all WP Directory Kit installations to identify affected versions and disable the plugin if not mission-critical. Within 7 days, implement Web Application Firewall rules blocking SQL injection patterns against the plugin, rotate all WordPress database credentials, and apply network-level database access restrictions to limit exposure. Within 30 days, monitor the vendor for patch availability and apply immediately upon release, or migrate to an alternative directory management plugin; no vendor-released patch identified at time of analysis, so plan for permanent replacement if patch timeline extends beyond 30 days.

WP Directory Kit EUVD-2026-57936

| CVE-2026-27538 HIGH

SQL Injection (CWE-89)

2026-08-13 Patchstack

GHSA-c33p-q727-j9jw

WordPress SQLi Wp Directory Kit Wordpress Plugin Wpdirectorykit

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Unauthenticated network vector confirmed by description; AC:H reflects specific endpoint condition required; S:C captures shared WordPress database cross-table exposure; I:N consistent with apparent read-only injection behavior.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:04 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

AnalysisAI

SQL injection in WP Directory Kit versions 1.5.4 and earlier enables remote unauthenticated attackers to extract sensitive database contents, including WordPress user credentials and site configuration data, without any account or prior foothold. The CVSS 3.1 score of 7.5 includes a Scope Changed designation, reflecting that the shared WordPress MySQL database - reachable by all installed plugins - is exposed beyond the plugin's own schema. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network attack path significantly lowers the barrier to exploitation.

Technical ContextAI

WP Directory Kit is a WordPress plugin (CPE: cpe:2.3:a:wpdirectorykit:wp_directory_kit:*:*:*:*:*:*:*:*) that provides directory listing and management functionality on WordPress sites. The root cause is CWE-89 - Improper Neutralization of Special Elements used in an SQL Command - meaning user-controlled input reaches the WordPress database layer (MySQL/MariaDB) without adequate sanitization or parameterized query enforcement. WordPress plugins share a common database with the WordPress core, making all tables (wp_users, wp_options, wp_usermeta, and tables from other plugins) accessible to a successful injection. The Scope Changed (S:C) component in the CVSS vector directly reflects this cross-table reachability. The AC:H rating indicates a specific plugin endpoint, parameter, or input condition must be triggered to exercise the vulnerable code path.

RemediationAI

Patch available per vendor advisory - update WP Directory Kit to a version beyond 1.5.4 immediately using the WordPress admin plugin update interface or WP-CLI. The exact first patched version number is not specified in the available intelligence; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-5-4-sql-injection-vulnerability to confirm the minimum safe release before upgrading. If an immediate update is not feasible, deactivating the plugin removes the attack surface entirely at the cost of losing all directory functionality. A web application firewall with SQL injection signature rules targeting the plugin's endpoints can serve as a compensating control but carries bypass risk and should not substitute for patching. IP-restricting the plugin's front-end endpoints is a stronger interim control where the directory's audience is known and limited. After patching, rotate WordPress admin credentials and any API keys stored in wp_options as a precaution, given the potential for prior unauthorized reads.