EUVD-2026-59912
GHSA-36g7-7w4m-4xmc
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
S:C reflects multisite authorization boundary crossing; I:L and A:N because demonstrated impact is cross-site data read, not confirmed destructive writes.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire network, which they are not otherwise able to reach.
AnalysisAI
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with materially elevated impact on WordPress multisite networks where a single-site admin can read data belonging to the entire network - data outside their authorized scope. A public PoC is available via WPScan, though EPSS sits at 0.17% (6th percentile), indicating targeted rather than opportunistic exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress administrator account - either a network super admin or a single-site administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects high-privilege-required network exploitation with full C/I/A impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or holds WordPress administrator credentials for a single site in a multisite network authenticates to the WP Directory Kit admin panel and submits a crafted request containing a SQL injection payload in the vulnerable parameter. The unsanitized input is executed against the shared network database, allowing the attacker to enumerate and dump tables from other sites on the network - extracting user credentials, email addresses, or other sensitive data that their site-admin role does not authorize them to access. … |
| Remediation | Update WP Directory Kit to version 1.5.7 or later, which includes the vendor-released patch adding proper sanitization and escaping of the affected SQL parameter. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, scan all WordPress installations for WP Directory Kit plugin versions below 1.5.7 and prioritize multisite networks for immediate assessment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Directory Kit
View allThe WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' pa
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers t
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticate
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to miss
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a m
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today