CVE-2026-118421mediumCWE-89

CVE-2026-118421: medium-severity vulnerability in WP Directory Kit

WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter

Published

Follow this CVE+ Monitor WP Directory Kit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.8epss 0.2%
The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on one of its admin screens before using it in a SQL statement, relying on a keyword deny-list whose replacement order can be bypassed, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected products
Unknown · WP Directory Kit
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WP Directory Kit

In the same product, most dangerous first.

CVE-2026-18473CRITICALWP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' ParameterEPSS 0.5%CVE-2026-18653HIGHWP Directory Kit < 1.5.7 - Admin+ SQL Injection via section ParameterEPSS 0.4%CVE-2026-18474HIGHWP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_categoryEPSS 0.4%CVE-2026-16594HIGHWP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key DisclosureEPSS 0.4%CVE-2026-118420MEDIUMWP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'main_field' ParameterEPSS 0.4%CVE-2026-16593MEDIUMWP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget SettingsEPSS 0.4%