SQL Injection Vulnerability in WP Directory Kit by WordPress
CVE-2025-13089
7.5HIGH
What is CVE-2025-13089?
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection due to insufficient parameter escaping and inadequate SQL query preparation. This vulnerability allows unauthenticated attackers to inject malicious SQL queries through the 'hide_fields' and 'attr_search' parameters, potentially granting them unauthorized access to sensitive database information. All versions up to and including 1.4.7 are affected, making it critical for users to update to secure their installations.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
WP Directory Kit * <= 1.4.7
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
tmrswrr