External risk intelligence

WP Directory Kit SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-18473

The vulnerability exists in a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications, and the exploit is reachable via a web request to the plugin's functionality, making public internet exposure of this attack surface a standard deployment pattern.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the WP Directory Kit WordPress plugin, allowing unauthenticated users to execute arbitrary SQL commands. This SQL injection flaw, if exploited, could lead to significant data compromise or manipulation within affected WordPress sites. The primary concern is to confirm if this plugin is in use and assess the potential exposure.

Unauthenticated SQL injection in a WordPress plugin.
Enables unauthorized data access or alteration.
Confirm plugin use and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to a WordPress site that uses the vulnerable plugin. The plugin fails to properly handle a specific parameter, allowing the attacker to inject malicious SQL code. This could lead to unauthorized access and modification of sensitive data stored in the website's database.

No authentication required to attack.
SQL injection via a plugin parameter.
Risk of unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated user to inject malicious SQL queries into the application when supported by the advisory. This could potentially lead to unauthorized access or modification of sensitive data stored in the database.

Database integrity and contents.
Via unsanitized parameter in SQL query.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this SQL injection vulnerability in the WP Directory Kit plugin. The first practical step is to identify all WordPress sites using the plugin, confirm their exposure to the internet, and determine the business criticality of each instance to prioritize remediation efforts with the accountable owner.

Identify application owners.
Verify plugin exposure and criticality.
Plan targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP Directory Kit plugin?

WP Directory Kit is a WordPress plugin designed to help site administrators build and manage directory-style websites. Users rely on it to list, organize, and display information—such as business listings, service providers, or classifieds—directly within their WordPress site's database structure.

How does CVE-2026-18473 create a security risk?

This vulnerability is classified as a SQL Injection (CWE-89). It occurs because the plugin fails to clean data provided by a user before including it in a database query. This weakness allows an attacker to manipulate the underlying SQL command, potentially giving them unauthorized access to read or alter the information stored in the site's database.

When can an attacker trigger this SQL injection?

The flaw is triggered when an attacker sends a specifically crafted request containing malicious input to the site. Because the plugin does not require any user account or special permissions to process these requests, the vulnerability is accessible to unauthenticated visitors. Simply browsing the site or accessing non-plugin pages does not trigger the vulnerability.

Is my site likely at risk from this vulnerability?

Halo Surface Signal notes that since this is a WordPress plugin, your site is more likely to be at risk if it is accessible to the public internet. Because the exploit is reachable through standard web requests, any public-facing installation using the affected versions of WP Directory Kit presents a direct attack surface.

How do I secure my site against this issue?

Begin by auditing your WordPress environment to identify if WP Directory Kit is installed and active. Check your plugin dashboard for version 1.5.5 or higher, as updating to the latest release is the standard way to resolve the flaw. If you cannot update immediately, consider disabling the plugin until you can apply the vendor's fix.

References

wpscan.com/vulnerability/a5596bc1-5ae9-4141-b027-85a0b91ecdab/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.