Time-Based SQL Injection in WP Directory Kit Plugin for WordPress

CVE-2026-96653

What is CVE-2026-96653?

The WP Directory Kit plugin for WordPress is susceptible to a time-based SQL Injection due to inadequate escaping of user-supplied parameters in the 'display_name' profile field. This vulnerability affects all versions up to and including 1.5.9. Authenticated attackers with subscriber-level access can manipulate stored data to append malicious SQL queries to existing queries. When a subscriber inputs a single quote in their display_name, it remains unchanged in the system. The vulnerability is exploited when the system processes this unsanitized data during certain operations, allowing attackers to extract sensitive information from the database.

References