Executive brief
The WP Directory Kit WordPress plugin contains a SQL injection vulnerability in its page builder widgets that fails to properly sanitize user input. An attacker with editor-level access can inject malicious SQL code through widget configuration fields, allowing them to extract sensitive data such as password hashes and other database contents when the page is viewed by any visitor.
Technical details
The vulnerability is a time-based blind SQL injection (CWE-89) in the Categories and Locations widget settings, specifically in the Order By and Order Direction fields. The plugin fails to sanitize and escape widget settings before using them in SQL queries. The attack requires an authenticated user with page builder access (Editor role or above) and Elementor active. An attacker can inject SQL expressions through raw JSON widget configuration, bypassing client-side validation. When the page is rendered by any visitor, the injected SQL executes, enabling boolean-based and time-based data exfiltration of arbitrary database contents. No patch has been released as of the advisory date.
Affected products
- WP Directory Kit WP Directory Kit through 1.5.7
Timeline
- 2026-09-12: disclosed: Publicly disclosed
- 2026-09-05: other: Added to vulnerability databases