CVE-2026-18473 PUBLISHED

WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter

Assigner: WPScan
Reserved: 31.07.2026 Published: 09.08.2026 Updated: 09.08.2026

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

Product Status

Vendor Unknown
Product WP Directory Kit
Versions Default: unaffected
  • affected from 1.5.4 to 1.5.5 (excl.)

Credits

  • Sai Praneeth Koti finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE