What is the CVSS score of EUVD-2026-57941?

EUVD-2026-57941 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of WP Directory Kit are affected by EUVD-2026-57941?

The WP Directory Kit WordPress plugin (v1.5.4 and earlier) contains a critical SQL injection vulnerability allowing unauthenticated remote attackers to directly access database contents including…

How to fix or mitigate EUVD-2026-57941?

Within 24 hours: immediately disable or uninstall WP Directory Kit from production environments; if removal is not feasible, implement a Web Application Firewall rule blocking requests to vulnerable endpoints and restrict access to administrator IP ranges only. Within 7 days: conduct forensic review of web server and database logs from the past 30 days for SQL injection patterns or unusual queries; reset all WordPress user passwords and API keys as a precaution; audit database access logs for unauthorized queries. Within 30 days: establish continuous vendor monitoring for a security patch release and plan an immediate production deployment upon availability; implement a plugin security assessment process to avoid similar vulnerabilities in future deployments.

WP Directory Kit EUVD-2026-57941

| CVE-2026-28001 CRITICAL

SQL Injection (CWE-89)

2026-08-13 Patchstack

GHSA-qgc9-3hm8-36pf

WordPress SQLi Wp Directory Kit Wordpress Plugin Wpdirectorykit

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) yields high confidentiality via data extraction and low integrity from possible writes; scope kept unchanged as impact stays within the WordPress DB context.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:01 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

AnalysisAI

SQL injection in the WP Directory Kit WordPress plugin (versions 1.5.4 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through unsanitized input, per a Patchstack disclosure carrying a 9.3 CVSS. Because no login is required (PR:N) and the CVSS marks a scope change with high confidentiality impact, an attacker can read sensitive database contents such as user credentials and WordPress secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

The vulnerability is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). WP Directory Kit is a PHP-based WordPress plugin that builds member/business directory listings, typically constructing database queries from search, filter, or listing parameters submitted over HTTP. When user-controlled input is concatenated into a SQL statement without parameterization or proper escaping, an attacker can alter query structure. The affected component is identified by CPE cpe:2.3:a:wpdirectorykit:wp_directory_kit:*:*:*:*:*:*:*:*, and the CVSS S:C (scope changed) reflects that the plugin's SQL runs against the shared WordPress database, potentially exposing data belonging to WordPress core and other plugins beyond the plugin's own tables.

RemediationAI

Update WP Directory Kit to the first release after 1.5.4 that contains the fix as published by the vendor; the input data does not name an exact fixed version, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-5-4-sql-injection-vulnerability-2) and the plugin changelog to confirm the patched build before deploying. Until patched, compensating controls include deploying a WAF rule (Patchstack, Wordfence, or ModSecurity) to block SQL injection patterns against the plugin's directory search/filter endpoints, which may cause false positives on legitimate complex search queries; restricting or temporarily deactivating the plugin if the directory feature is non-essential, which removes the directory functionality entirely; and limiting database user privileges for the WordPress account to reduce the blast radius of successful injection, at the cost of breaking any plugin features that require broad DB grants.