Unauthenticated SQL Injection in WP Directory Kit by WordPress
CVE-2026-28001

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
WP Directory Kit
Vendor
CVE Published:
13 August 2026

What is CVE-2026-28001?

A significant vulnerability exists in the WP Directory Kit plugin for WordPress, specifically affecting versions up to 1.5.4. This vulnerability allows unauthenticated attackers to execute arbitrary SQL commands through specially crafted requests. If exploited, this issue can lead to unauthorized access to sensitive data, database manipulation, and potential broader compromise of the website. It is essential for web administrators to update to the latest version and implement appropriate security measures to mitigate risks associated with such vulnerabilities.

Affected Version(s)

WP Directory Kit <= 1.5.4

References

https://patchstack.com/database/wordpress/plugin/wpdirect...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jayant Kamble | Patchstack Bug Bounty Program
.