Executive brief
WP Directory Kit, a WordPress plugin used for creating directory listings, contains a critical security flaw that allows unauthorized access to the website's database. An attacker can exploit this to steal sensitive information or disrupt site operations without needing any login credentials. This type of vulnerability is frequently targeted in automated mass-exploitation campaigns against WordPress sites.
Technical details
The WP Directory Kit plugin for WordPress (versions up to and including 1.5.1) is vulnerable to a Blind SQL Injection due to improper neutralization of special elements in SQL commands. The vulnerability is exploitable by unauthenticated remote attackers over the network with low complexity. Because the flaw allows for blind injection, an attacker can infer data from the database by observing differences in server responses or timing. This can lead to full data exfiltration of the WordPress database. The issue is resolved in version 1.5.2.
Affected products
- Wp Directory Kit WP Directory Kit <= 1.5.1
Timeline
- 2026-04-14: other: Reported by researcher daroo
- 2026-05-14: advisory: Initial Patchstack advisory published
- 2026-06-01: disclosed: CVE published to NVD
- 2026-05-14: patched: Version 1.5.2 released to address the vulnerability