SQL Injection Vulnerability in WP Directory Kit Plugin for WordPress
CVE-2026-118421
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 November 2026
Badges
What is CVE-2026-118421?
The WP Directory Kit plugin for WordPress, prior to version 1.6.3, is susceptible to SQL injection attacks due to improper sanitization and escaping of parameters used in ordering results on its admin screen. Specifically, it relies on a keyword deny-list whose order can be bypassed. This vulnerability enables users with the custom Listing Admin role and higher to manipulate SQL statements, potentially allowing unauthorized access to the database. Site administrators should ensure they update to the latest version to mitigate the risk associated with this exploit.
Affected Version(s)
WP Directory Kit 0 < 1.6.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.