CVE-2026-42672criticalCWE-89

CVE-2026-42672: critical vulnerability in WP Directory Kit

WordPress WP Directory Kit plugin <= 1.5.1 - SQL Injection vulnerability

Published

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.4%
exploitation probability
0.4%top 67% of all CVEs
observed exploitation
nono source reports it
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Affected products
Wp Directory Kit · WP Directory Kit
Related CVEs — WP Directory Kit

In the same product, most dangerous first.

CVE-2026-39531CRITICALWordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-39534HIGHWordPress WP Directory Kit plugin <= 1.5.0 - Broken Access Control vulnerabilityEPSS 0.4%
References
https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-5-1-sql-injection-vulnerability?_s_id=cve