---
id: "CVE-2026-118421"
page: "https://infrastack.ai/live/CVE-2026-118421"
kind: "vulnerability"
aliases: ["CVE-2026-118421"]
title: "WP Directory Kit WordPress plugin: SQL injection through admin order parameter"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wp-directory-kit"]
not_affected_if: ["no-listing-admin-users", "plugin-version-1.6.3-or-later"]
published_at: "2026-11-12T06:17:11+00:00"
first_seen_at: "2026-11-12T06:36:51+00:00"
updated_at: "2026-11-12T06:38:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118421", "first_seen_at": "2026-11-12T06:36:51+00:00"}]
exploit_sources: []
---

# WP Directory Kit WordPress plugin: SQL injection through admin order parameter

Link for people: https://infrastack.ai/live/CVE-2026-118421 (this .md is for agents)

The WP Directory Kit WordPress plugin before 1.6.3 fails to properly sanitise a parameter that orders results on an admin screen, and its keyword filter can be bypassed. Users with the custom Listing Admin role or higher can use this to run SQL injection against the site database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WP Directory Kit version in the WordPress admin plugin list or `wp plugin get wp-directory-kit --field=version`
- Confirm whether any users hold the custom Listing Admin role

## Fix

- WP Directory Kit: `1.6.3`

## Timeline

- 2026-11-12T06:36:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118421

## From the sources

The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on one of its admin screens before using it in a SQL statement, relying on a keyword deny-list whose replacement order can be bypassed, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_