CVE-2026-18474 PUBLISHED

WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category

Assigner: WPScan
Reserved: 31.07.2026 Published: 12.08.2026 Updated: 12.08.2026

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.

Product Status

Vendor Unknown
Product WP Directory Kit
Versions Default: unaffected
  • affected from 0 to 1.5.6 (excl.)

Credits

  • Pedro Pinho finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE