External risk intelligence

Web Directory Free Unauthenticated SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-28142

The vulnerability affects a web plugin designed for directory management, which is typically deployed as a public-facing component of a website to allow user interaction and content browsing, making it highly accessible from the internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a web directory plugin that could allow unauthorized access to sensitive information. This issue stems from an SQL injection flaw, meaning attackers can manipulate database queries to potentially extract data. Given the plugin's function, its public-facing nature makes it a plausible target. The primary concern is to determine if this plugin is in use and, if so, assess the potential exposure of any associated data.

Unauthenticated database manipulation is possible.
Affects publicly accessible website features.
Confirm usage and data exposure relevance.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests over the network to a web server hosting the affected directory plugin. This requires no authentication or user interaction, and the attacker targets the plugin's handling of web directory data. Successful exploitation could lead to unauthorized access to sensitive database information and potentially impact the availability of the application.

No authentication needed.
SQL injection in web directory feature.
Sensitive data exposure and denial of service.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated SQL injection in Web Directory Free could allow an attacker to interfere with the application's logic, potentially leading to unauthorized access to sensitive information. This vulnerability exists when the plugin is used, and the extent of data exposure or service disruption depends on the specific configurations and data handled by the application.

System data and service integrity at risk.
Exposure via unauthenticated network requests.
Potential for unauthorized data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical SQL injection vulnerability in Web Directory Free affects unauthenticated users and is exposed externally. Responsibility for remediation likely falls to the application owner or platform team managing the web server, in coordination with the security team to assess business criticality and exposure. The first practical step is to identify all instances of the affected technology, confirm their reachability and business impact, and then engage the accountable owner to plan remediation.

Application owners should prioritize remediation.
Verify external reachability and business impact.
Plan vendor coordination and apply fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Web Directory Free plugin?

Web Directory Free is a WordPress plugin used to manage and display searchable listings or directories on a website. It allows site visitors to browse content and interact with directory features directly through their browsers, making it a common tool for building resource lists, business directories, or classified ad sections.

What does SQL injection mean for CVE-2026-28142?

This vulnerability is classified as CWE-89, or SQL Injection. It means the plugin does not properly sanitize data before using it in database queries. Because of this, an attacker can input malicious commands that the database executes, allowing them to bypass normal security controls to view or manipulate sensitive information stored by the plugin.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by sending specially crafted network requests to the website hosting the plugin. No authentication or user interaction is required to initiate the attack. Crucially, the vulnerability relies on the plugin's interaction with the database; standard requests that do not contain malicious input will not trigger the flaw.

Is my site at risk from CVE-2026-28142?

According to Halo Surface Signal, this plugin is typically deployed as a public-facing component to facilitate user interaction. Because it is designed to be accessible from the internet, it is considered highly exposed. If your site runs this plugin, it is likely reachable by unauthorized users over the network.

Do I need to take action if I use this plugin?

Yes. Start by identifying all instances of Web Directory Free within your environment. Verify whether the affected versions are in use and assess the sensitivity of the data handled by the plugin. Once identified, coordinate with your team to plan for updates or necessary security adjustments to mitigate the risk of unauthorized database access.

References

patchstack.com/database/wordpress/plugin/web-directory-free/vulnerab…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.