Is CVE-2026-42672 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42672 being exploited in the wild.

How severe is CVE-2026-42672?

Critical severity, with a CVSS score of 9.3, published 1 June 2026.

Is there a fix for CVE-2026-42672?

A patch was published on 2026-05-14: Version 1.5.2 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42672 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42672?

Check whether you run WP Directory Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42672: Wp Directory Kit WP Directory Kit SQL injection

CVE-2026-42672 · Severity: critical · CVSS 9.3 · Published 2026-06-01

WP Directory Kit, a WordPress plugin used for creating directory listings, contains a critical security flaw that allows unauthorized access to the website's database. An attacker can exploit this to steal sensitive information or disrupt site operations without needing any login credentials. This type of vulnerability is frequently targeted in automated mass-exploitation campaigns against WordPress sites.

Technologies: WP Directory Kit. Vendors: WP Directory Kit.

Quick answers

Is CVE-2026-42672 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42672 being exploited in the wild.
How severe is CVE-2026-42672?: Critical severity, with a CVSS score of 9.3, published 1 June 2026.
Which products and versions are affected?: WP Directory Kit <= 1.5.1.
Is there a fix for CVE-2026-42672?: A patch was published on 2026-05-14: Version 1.5.2 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42672 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42672?: Check whether you run WP Directory Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WP Directory Kit plugin for WordPress (versions up to and including 1.5.1) is vulnerable to a Blind SQL Injection due to improper neutralization of special elements in SQL commands. The vulnerability is exploitable by unauthenticated remote attackers over the network with low complexity. Because the flaw allows for blind injection, an attacker can infer data from the database by observing differences in server responses or timing. This can lead to full data exfiltration of the WordPress database. The issue is resolved in version 1.5.2.

Affected products

Wp Directory Kit WP Directory Kit <= 1.5.1

Timeline

2026-04-14: other: Reported by researcher daroo
2026-05-14: advisory: Initial Patchstack advisory published
2026-06-01: disclosed: CVE published to NVD
2026-05-14: patched: Version 1.5.2 released to address the vulnerability

References

https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-5-1-sql-injection-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.