CVE-2026-118421 · Package
NO FIX YET · SEE WHAT TO DO
The WP Directory Kit WordPress plugin before 1.6.3 fails to properly sanitise a parameter that orders results on an admin screen, and its keyword filter can be bypassed. Users with the custom Listing Admin role or higher can use this to run SQL injection against the site database.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the WP Directory Kit plugin before 1.6.3 where users hold the Listing Admin role or higher. Sites without this plugin, or without users in that role, are not exposed through this flaw. The sources do not say whether the flaw is reachable by unauthenticated visitors.
Not affected if no-listing-admin-users, plugin-version-1.6.3-or-later
Who cares wordpress, wp-directory-kit
wp plugin get wp-directory-kit --field=version1.6.3The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on one of its admin screens before using it in a SQL statement, relying on a keyword deny-list whose replacement order can be bypassed, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.