CVE-2025-13138: fallo de gravedad alta en wpdirectorykit WP Directory Kit
WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function
Publicada el · Actualizada el
36Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 7.5epss 1.5%
probabilidad de explotación
1.5%top 26% de las CVE
explotación observada
noninguna fuente lo reporta
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
wpdirectorykit · WP Directory KitCVEs relacionadas — wpdirectorykit WP Directory Kit
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-3217HIGHWP Directory Kit <= 1.3.0 - Authenticated (Subscriber+) SQL InjectionEPSS 1.9%CVE-2023-2278CRITICALWP Directory Kit <= 1.1.9 - Unauthenticated Local File Inclusion via wdk_public_actionEPSS 1.7%CVE-2025-13920MEDIUMWP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_actionEPSS 0.7%CVE-2023-2835MEDIUMWP Directory Kit <= 1.2.3 - Reflected Cross-Site Scripting via 'search'EPSS 0.7%CVE-2023-2351MEDIUMWP Directory Kit <= 1.2.3 - Missing Authorization to Plugin Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_admin_actionEPSS 0.6%CVE-2023-2280MEDIUMWP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_actionEPSS 0.6%
Referencias
https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.4.3/application/controllers/Wdk_frontendajax.php#L546https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3396348%40wpdirectorykit&new=3396348%40wpdirectorykit&sfp_email=&sfph_mail=https://wordpress.org/plugins/wpdirectorykit/https://www.wordfence.com/threat-intel/vulnerabilities/id/0cad8c48-5c96-484c-acda-b33d8d8d10d3?source=cve