# CVE-2026-42672: Wp Directory Kit WP Directory Kit SQL injection

Source: https://junglewise.ai/threats/cve-2026-42672-wp-directory-kit-wp-directory-kit-sql-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-42672 · Severity: critical · CVSS 9.3 · Published 2026-06-01

WP Directory Kit, a WordPress plugin used for creating directory listings, contains a critical security flaw that allows unauthorized access to the website's database. An attacker can exploit this to steal sensitive information or disrupt site operations without needing any login credentials. This type of vulnerability is frequently targeted in automated mass-exploitation campaigns against WordPress sites.

Technologies: [WP Directory Kit](https://junglewise.ai/threats/technologies/wp-directory-kit). Vendors: [WP Directory Kit](https://junglewise.ai/threats/vendors/wp-directory-kit).

## Quick answers

**Is CVE-2026-42672 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42672 being exploited in the wild.

**How severe is CVE-2026-42672?** Critical severity, with a CVSS score of 9.3, published 1 June 2026.

**Which products and versions are affected?** WP Directory Kit <= 1.5.1.

**Is there a fix for CVE-2026-42672?** A patch was published on 2026-05-14: Version 1.5.2 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42672 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-42672?** Check whether you run WP Directory Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WP Directory Kit plugin for WordPress (versions up to and including 1.5.1) is vulnerable to a Blind SQL Injection due to improper neutralization of special elements in SQL commands. The vulnerability is exploitable by unauthenticated remote attackers over the network with low complexity. Because the flaw allows for blind injection, an attacker can infer data from the database by observing differences in server responses or timing. This can lead to full data exfiltration of the WordPress database. The issue is resolved in version 1.5.2.

## Affected products

- Wp Directory Kit WP Directory Kit <= 1.5.1

## Timeline

- 2026-04-14: other: Reported by researcher daroo
- 2026-05-14: advisory: Initial Patchstack advisory published
- 2026-06-01: disclosed: CVE published to NVD
- 2026-05-14: patched: Version 1.5.2 released to address the vulnerability

## References

- [https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-5-1-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-5-1-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [WP Directory Kit SQL injection in order parameter](https://junglewise.ai/threats/cve-2026-118421-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not)
- [WP Directory Kit SQL injection via main_field parameter](https://junglewise.ai/threats/cve-2026-118420-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not)
- [WP Directory Kit unauthenticated data disclosure](https://junglewise.ai/threats/cve-2026-118418-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not)
- [WP Directory Kit SQL injection in idfield parameter](https://junglewise.ai/threats/cve-2026-109197-the-wp-directory-kit-plugin-for-wordpress-is-vulnerable-to)
- [WP Directory Kit SQL injection in data_fields_list parameter](https://junglewise.ai/threats/cve-2026-16596-the-wp-directory-kit-plugin-for-wordpress-is-vulnerable-to)