WP Directory Kit: SQL injection in idfield parameter (CVE-2026-109197)
The WP Directory Kit WordPress plugin is vulnerable to unauthenticated SQL injection via the idfield parameter due to insufficient input sanitization, enabling potential data exfiltration.
CVE search metadata
CVE search record: CVE-2026-109197. Severity: high. CVSS: 7.5. KEV: no. Product: WP Directory Kit (<= 1.6.0). Brief: WP Directory Kit: SQL injection in idfield parameter (CVE-2026-109197). Brief link: https://feed.craftedsignal.io/briefs/2026-10-wp-directory-kit/
Triage facts
Revision 1- Applicability
- WP Directory Kit (<= 1.6.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 11:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The WP Directory Kit plugin for WordPress (all versions up to and including 1.6.0) contains a vulnerability that allows unauthenticated SQL injection. The flaw exists in the 'idfield' parameter, where user-supplied input is not properly escaped before being included in a SQL query. This failure to use prepared statements allows attackers to inject arbitrary SQL commands.
Impact
Successful exploitation allows unauthenticated attackers to append malicious SQL commands to existing queries, which can be leveraged to extract sensitive information from the underlying database.
Recommendation
- Inventory all WordPress installations to identify instances of the WP Directory Kit plugin.
- Disable or remove the plugin until a patch is released by the vendor, as no fixed version is currently specified in the source.
- Review web server access logs for requests containing SQL injection patterns directed at common WordPress plugin paths and query parameters.
Immediate actions
Identify and disable vulnerable WP Directory Kit plugin versions (<= 1.6.0) across all web assets.
Threat Hunt
Monitor web server logs for requests to site paths containing the idfield parameter with SQL injection syntax (e.g., UNION, SELECT, OR 1=1).
Data: Web server access logs (cs-uri-query, cs-uri-stem)
Mitigations
Deactivate the WP Directory Kit plugin until a vendor patch is provided.
CVE-2026-109197