Executive brief
WP Directory Kit is a WordPress plugin that creates searchable business directories on websites. The plugin fails to properly validate search input on the location and category fields when configured with specific dropdown types, allowing unauthenticated attackers to execute SQL injection attacks and extract sensitive data like administrator password hashes directly from the database.
Technical details
The vulnerability is a SQL injection flaw in the plugin's search parameter handling. When the "Location field Search" or "Category field Search" is configured as "Multi Select Dropdown" (non-default setting), the plugin fails to sanitize and escape user-supplied values before embedding them in SQL IN() clauses. Attack vectors are the search_location[] and search_category[] parameters passed via GET request, requiring no authentication or CSRF token. An unauthenticated attacker can execute arbitrary SQL through time-delay or boolean-based oracle techniques, completely bypassing WordPress magic quotes because the injected value lands in an unquoted numeric context. The vendor released patch version 1.5.6, which casts all submitted values to integers before constructing the SQL query, effectively blocking the injection.
Affected products
- WP Directory Kit WP Directory Kit before 1.5.6
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: Fixed in version 1.5.6