SQL Injection Vulnerability in WP Directory Kit Plugin by WordPress
CVE-2026-118420
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 November 2026
Badges
What is CVE-2026-118420?
The WP Directory Kit plugin for WordPress versions prior to 1.6.3 contains a security flaw that fails to properly sanitize and escape user input before it is incorporated into an SQL statement. This oversight allows users with specific roles, particularly those with the custom Listing Admin role or higher, to exploit the vulnerability and execute SQL injection attacks. Such attacks could potentially lead to unauthorized data access, manipulation, or system compromise, posing serious risks to the integrity and security of the hosting environment.
Affected Version(s)
WP Directory Kit 0 < 1.6.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.