SQL Injection Vulnerability in WP Directory Kit by WordPress
CVE-2025-13089
7.5HIGH
What is CVE-2025-13089?
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection due to insufficient parameter escaping and inadequate SQL query preparation. This vulnerability allows unauthenticated attackers to inject malicious SQL queries through the 'hide_fields' and 'attr_search' parameters, potentially granting them unauthorized access to sensitive database information. All versions up to and including 1.4.7 are affected, making it critical for users to update to secure their installations.
Affected Version(s)
WP Directory Kit * <= 1.4.7