SQL Injection Vulnerability in WP Directory Kit Plugin for WordPress

CVE-2026-109197

What is CVE-2026-109197?

The WP Directory Kit plugin for WordPress is susceptible to a SQL injection attack through the 'idfield' parameter due to inadequate escaping of user-supplied input and insufficient preparation of the SQL query. This vulnerability allows unauthenticated attackers to insert additional SQL queries into existing ones, potentially leading to the exposure of sensitive database information. Implementing proper input validation and escaping mechanisms is essential to mitigate the risks associated with this vulnerability.

References