External risk intelligence

Unauthenticated SQL Injection in WP Directory Kit Plugin

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-28001

The vulnerability affects a WordPress plugin, which is a type of web application component typically deployed as part of a public-facing website. Plugins are designed to handle incoming web traffic, making the exposed surface area likely to be reachable from the internet in common deployment patterns.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in a popular WordPress plugin, allowing unauthenticated attackers to potentially access sensitive database information. This vulnerability could impact websites utilizing this plugin, presenting a risk to data integrity and potentially affecting service availability. The main concern is confirming relevance and exposure to understand potential impacts.

Attackers can steal website data.
It's a widespread, easy-to-exploit flaw.
Assess if our sites use this plugin.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted input over the network to a vulnerable WordPress site. This input targets the WP Directory Kit plugin, which may not properly sanitize incoming data, leading to SQL injection. If successful, an attacker could potentially gain unauthorized access to sensitive database information and disrupt the site's availability.

No authentication required.
Triggered by unsanitized user input.
Risk of data exposure and denial of service.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to perform SQL injection when supported by the advisory. This may affect the integrity and availability of the underlying database.

Database content could be affected.
SQL injection via network requests.
Potential for unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in the WP Directory Kit plugin likely impacts organizations using WordPress for their public-facing websites. Initial triage should focus on identifying all instances of the affected plugin, assessing their exposure and business criticality, and confirming the accountable owner, potentially within the web application or infrastructure teams. Planning remediation should then be risk-based, considering factors like vendor coordination and maintenance windows.

Web application or platform teams own remediation.
Verify plugin presence and external reachability.
Plan and execute updates based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP Directory Kit plugin?

WP Directory Kit is a component for WordPress websites used to manage and display directory-style listings. It adds specialized features for organizing business or member data directly within the WordPress dashboard, functioning as an extension that processes web requests to deliver site content to visitors.

How does CVE-2026-28001 work?

This CVE involves a vulnerability classified as CWE-89, or SQL Injection. This occurs when software fails to properly filter or clean data sent by a user before including it in a database query. Consequently, an attacker can manipulate these queries to bypass standard controls and interact directly with the underlying database.

Do I need to be logged in for an attacker to trigger this?

No. This vulnerability is unauthenticated, meaning an attacker does not need an account or valid credentials to send the malicious input. It is specifically triggered by network requests directed at the plugin, so site activity that does not involve interacting with the plugin's specific input fields will not initiate the flaw.

Is my site at risk if it uses WP Directory Kit?

Halo Surface Signal indicates that because this plugin is designed to handle web traffic for public-facing websites, it is highly likely to be reachable from the internet. If your WordPress site is connected to the web and uses a vulnerable version, your database contents may be accessible to unauthorized external parties.

When should I take action for this vulnerability?

You should prioritize this immediately by identifying every site where WP Directory Kit is installed. Once you have a complete inventory, verify if the version is 1.5.4 or older. Coordinate with your web management team to confirm ownership and schedule updates to a secure version to prevent database compromise.

References

patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerabilit…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.