{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awp_directory_kit_projectwp_directory_kitwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wp_directory_kit_project:wp_directory_kit:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-109197"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WP Directory Kit (\u003c= 1.6.0)"],"_cs_severities":["high"],"_cs_tags":["wordpress","sql-injection","web-application"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe WP Directory Kit plugin for WordPress (all versions up to and including 1.6.0) contains a vulnerability that allows unauthenticated SQL injection. The flaw exists in the 'idfield' parameter, where user-supplied input is not properly escaped before being included in a SQL query. This failure to use prepared statements allows attackers to inject arbitrary SQL commands.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to append malicious SQL commands to existing queries, which can be leveraged to extract sensitive information from the underlying database.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all WordPress installations to identify instances of the WP Directory Kit plugin.\u003c/li\u003e\n\u003cli\u003eDisable or remove the plugin until a patch is released by the vendor, as no fixed version is currently specified in the source.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for requests containing SQL injection patterns directed at common WordPress plugin paths and query parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T11:57:34Z","date_published":"2026-10-31T11:57:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wp-directory-kit/","summary":"The WP Directory Kit WordPress plugin is vulnerable to unauthenticated SQL injection via the idfield parameter due to insufficient input sanitization, enabling potential data exfiltration.","title":"WP Directory Kit: SQL injection in idfield parameter (CVE-2026-109197)","url":"https://feed.craftedsignal.io/briefs/2026-10-wp-directory-kit/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wp_directory_kit_project:wp_directory_kit:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}