Time-based SQL Injection Vulnerability in Web 2.0 Directory Plugin for WordPress

CVE-2026-15272

What is CVE-2026-15272?

The Web 2.0 Directory plugin for WordPress contains a vulnerability that allows unauthenticated attackers to execute time-based SQL injection through the 'w2dc_level_filter' parameter. This occurs in all versions up to and including 2.10.12 due to insufficient parameter escaping and the lack of adequate preparation for the SQL query. Attackers can exploit this flaw by appending additional SQL queries to retrieve sensitive data from the database. As the parameter is utilized in an integer context without proper quoting, WordPress's built-in escaping mechanisms, such as addslashes/magic_quotes, fail to prevent the execution of malicious payloads, particularly those employing SLEEP-based conditionals.

References