{"id":"CVE-2026-118421","kind":"vulnerability","aliases":["CVE-2026-118421"],"related":[],"title":"WP Directory Kit WordPress plugin: SQL injection through admin order parameter","description":"The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on one of its admin screens before using it in a SQL statement, relying on a keyword deny-list whose replacement order can be bypassed, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks.","summary":"The WP Directory Kit WordPress plugin before 1.6.3 fails to properly sanitise a parameter that orders results on an admin screen, and its keyword filter can be bypassed. Users with the custom Listing Admin role or higher can use this to run SQL injection against the site database.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-directory-kit"],"not_affected_if":["no-listing-admin-users","plugin-version-1.6.3-or-later"],"how_to_check":"- Check the installed WP Directory Kit version in the WordPress admin plugin list or `wp plugin get wp-directory-kit --field=version`\n- Confirm whether any users hold the custom Listing Admin role","fix":"- WP Directory Kit: `1.6.3`","status":"open","published_at":"2026-11-12T06:17:11+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","triaged_at":"2026-11-12T06:38:02+00:00","updated_at":"2026-11-12T06:38:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T06:38:02Z","model":"claude-haiku-5-5","output":{"fix":"- WP Directory Kit: `1.6.3`","reach":"internet","title":"WP Directory Kit WordPress plugin: SQL injection through admin order parameter","impact":"high","summary":"The WP Directory Kit WordPress plugin before 1.6.3 fails to properly sanitise a parameter that orders results on an admin screen, and its keyword filter can be bypassed. Users with the custom Listing Admin role or higher can use this to run SQL injection against the site database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-directory-kit"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated Listing Admin user reads or alters site database contents","analyst_note":"","how_to_check":"- Check the installed WP Directory Kit version in the WordPress admin plugin list or `wp plugin get wp-directory-kit --field=version`\n- Confirm whether any users hold the custom Listing Admin role","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-1.6.3-or-later","no-listing-admin-users"],"who_is_affected":"Sites running the WP Directory Kit plugin before 1.6.3 where users hold the Listing Admin role or higher. Sites without this plugin, or without users in that role, are not exposed through this flaw. The sources do not say whether the flaw is reachable by unauthenticated visitors.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00074,"input_tokens":4594,"output_tokens":562,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118421':14A,17A '-2026':13A,16A '1.6.3':31B,79C,131C 'admin':9A,43B,57B,96C,135C 'attack':143C 'bypass':51B,117C 'custom':55B,133C 'cve':12A,15A 'databas':71B 'deni':110C 'deny-list':109C 'directori':2A,22B,26B,74C,126C 'escap':85C 'fail':32B 'filter':48B 'higher':60B 'hold':123C 'inject':7A,67B,142C 'keyword':47B,108C 'kit':3A,23B,27B,75C,127C 'list':56B,111C,134C 'make':118C 'one':93C 'order':10A,39B,90C,114C 'packag':18B 'paramet':11A,37B,87C 'perform':140C 'plugin':5A,29B,77C,129C 'possibl':120C 'proper':34B,82C 'reli':105C 'replac':113C 'result':40B,91C 'role':58B,136C 'run':65B 'sanitis':35B,83C 'screen':44B,97C 'site':70B 'sql':6A,66B,103C,141C 'statement':104C 'use':62B,88C,99C 'user':52B,122C 'whose':112C 'wordpress':4A,19B,28B,76C,128C 'wp':1A,21B,25B,73C,125C 'wp-directory-kit':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Directory Kit plugin before 1.6.3 where users hold the Listing Admin role or higher. Sites without this plugin, or without users in that role, are not exposed through this flaw. The sources do not say whether the flaw is reachable by unauthenticated visitors.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["package","unknown","wordpress","wpdirectorykit"],"campaign_type":null,"search_a":"'-118421':14A,17A '-2026':13A,16A 'admin':9A 'cve':12A,15A 'directori':2A 'inject':7A 'kit':3A 'order':10A 'paramet':11A 'plugin':5A 'sql':6A 'wordpress':4A 'wp':1A","search_b":"'1.6.3':31B 'admin':43B,57B 'bypass':51B 'custom':55B 'databas':71B 'directori':22B,26B 'fail':32B 'filter':48B 'higher':60B 'inject':67B 'keyword':47B 'kit':23B,27B 'list':56B 'order':39B 'packag':18B 'paramet':37B 'plugin':29B 'proper':34B 'result':40B 'role':58B 'run':65B 'sanitis':35B 'screen':44B 'site':70B 'sql':66B 'use':62B 'user':52B 'wordpress':19B,28B 'wp':21B,25B 'wp-directory-kit':20B","search_c":"'1.6.3':79C,131C 'admin':96C,135C 'attack':143C 'bypass':117C 'custom':133C 'deni':110C 'deny-list':109C 'directori':74C,126C 'escap':85C 'hold':123C 'inject':142C 'keyword':108C 'kit':75C,127C 'list':111C,134C 'make':118C 'one':93C 'order':90C,114C 'paramet':87C 'perform':140C 'plugin':77C,129C 'possibl':120C 'proper':82C 'reli':105C 'replac':113C 'result':91C 'role':136C 'sanitis':83C 'screen':97C 'sql':103C,141C 'statement':104C 'use':88C,99C 'user':122C 'whose':112C 'wordpress':76C,128C 'wp':73C,125C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118421","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118421","severity":null,"published_at":"2026-11-12T06:17:11+00:00","modified_at":"2026-11-12T06:17:11+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","fetched_at":"2026-11-12T06:36:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}