WordPress Plugin Vulnerabilities

WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category

Description

The plugin does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.

Proof of Concept

Affects Plugins

Plugin icon
wpdirectorykit
Fixed in 1.5.6

References

CVE
CVE-2026-18474

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
cadb99e3-bb6a-4d44-8ef0-eff524d31b29

Timeline

Publicly Published
2026-08-10 (about 2 days ago)
Added
2026-08-10 (about 1 day ago)
Last Updated
2026-08-11 (about 8 hours ago)

Other

Published
Title
Published
2025-12-11
Title
FunnelKit < 3.14.0.3 - Unauthenticated SQL Injection
Published
2026-06-08
Title
Booking (Reservation & Appointment) < 3.0.4 - Authenticated (Subscriber+) SQL Injection
Published
2021-10-11
Title
MAZ Loader < 1.3.3 - Contributor+ SQL Injection
Published
2025-10-02
Title
Wp cycle text announcement <= 8.1 - Authenticated (Contributor+) SQL Injection
Published
2026-06-24
Title
Dokan Pro < 5.0.5 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters