Executive brief
WP Directory Kit is a popular WordPress plugin for creating and managing business directories. A vulnerability in the plugin's AJAX handler allows any logged-in user, including those with minimal privileges, to inject malicious SQL code into database queries. An attacker could extract sensitive data (such as administrator password hashes), modify database contents, or disrupt normal site operations.
Technical details
The plugin does not sanitise or escape the "section" parameter before using it in an SQL statement within an authenticated AJAX action (wdk_admin_action). Although the endpoint requires WordPress authentication, it lacks proper role-based authorization checks, allowing any authenticated user (e.g., a Subscriber) to trigger SQL injection. The vulnerability can be exploited via blind time-based techniques to extract database values byte-by-byte. Attack preconditions: a logged-in user account with any role. The impact includes confidentiality breach (data extraction), integrity violation (database modification), and availability impact (SLEEP-based denial). The vulnerability was fixed in version 1.5.6 by enforcing administrator-only access.
Affected products
- WP Directory Kit WP Directory Kit before 1.5.6
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: fixed in version 1.5.6