Quick answers
- Is CVE-2026-18474 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18474 being exploited in the wild.
- How severe is CVE-2026-18474?
- High severity, with a CVSS score of 8.6, published 12 August 2026.
- Which products and versions are affected?
- WP Directory Kit before 1.5.6.
- Is there a fix for CVE-2026-18474?
- A patch was published on 2026-08-12: Fixed in version 1.5.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18474 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-18474?
- Check whether you run WP Directory Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a SQL injection flaw in the plugin's search parameter handling. When the "Location field Search" or "Category field Search" is configured as "Multi Select Dropdown" (non-default setting), the plugin fails to sanitize and escape user-supplied values before embedding them in SQL IN() clauses. Attack vectors are the search_location[] and search_category[] parameters passed via GET request, requiring no authentication or CSRF token. An unauthenticated attacker can execute arbitrary SQL through time-delay or boolean-based oracle techniques, completely bypassing WordPress magic quotes because the injected value lands in an unquoted numeric context. The vendor released patch version 1.5.6, which casts all submitted values to integers before constructing the SQL query, effectively blocking the injection.
Affected products
- WP Directory Kit WP Directory Kit before 1.5.6
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: Fixed in version 1.5.6