CVE-2026-118420 · Package
NO FIX YET · SEE WHAT TO DO
The WP Directory Kit WordPress plugin before 1.6.3 passes an unsanitised parameter into a SQL statement. A logged-in user with the custom Listing Admin role or higher can run SQL injection against the site's database.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the WP Directory Kit WordPress plugin before 1.6.3 where users hold the custom Listing Admin role or higher. The attacker must already have a logged-in account with that role, so sites with no such accounts are at lower risk. Sites on 1.6.3 or later are not affected.
Not affected if no-listing-admin-users, version-1.6.3-or-later
Who cares wordpress, wp-directory-kit
wp-content/plugins/ for the plugin's version header.1.6.3 (any version before 1.6.3 is affected)The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL statement, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.