Cpe:2.3:a:wp_directory_kit_project:wp_directory_kit:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awp_directory_kit_projectwp_directory_kitwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 11:57:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWP Directory Kit: SQL injection in idfield parameter (CVE-2026-109197)https://feed.craftedsignal.io/briefs/2026-10-wp-directory-kit/Sat, 31 Oct 2026 11:57:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wp-directory-kit/The WP Directory Kit WordPress plugin is vulnerable to unauthenticated SQL injection via the idfield parameter due to insufficient input sanitization, enabling potential data exfiltration.The WP Directory Kit plugin for WordPress (all versions up to and including 1.6.0) contains a vulnerability that allows unauthenticated SQL injection. The flaw exists in the 'idfield' parameter, where user-supplied input is not properly escaped before being included in a SQL query. This failure to use prepared statements allows attackers to inject arbitrary SQL commands.

Impact

Successful exploitation allows unauthenticated attackers to append malicious SQL commands to existing queries, which can be leveraged to extract sensitive information from the underlying database.

Recommendation

  • Inventory all WordPress installations to identify instances of the WP Directory Kit plugin.
  • Disable or remove the plugin until a patch is released by the vendor, as no fixed version is currently specified in the source.
  • Review web server access logs for requests containing SQL injection patterns directed at common WordPress plugin paths and query parameters.
]]>highadvisorywordpresssql-injectionweb-application