CVE-2026-42672

Vulnerability

The WP Directory Kit plugin for WordPress is susceptible to a blind SQL injection vulnerability due to improper neutralization of special elements used in SQL commands. This flaw exists in all versions from n/a through 1.5.1 and allows an attacker to manipulate database queries by injecting malicious SQL statements [1].

Exploitation

An attacker can exploit this vulnerability by sending crafted HTTP requests to the target site. Because the vulnerability is a blind SQL injection, the attacker does not require authentication or specific user interaction to interact with the database, making it suitable for automated mass-exploit campaigns [1].

Impact

Successful exploitation allows a malicious actor to directly interact with the underlying database. This can lead to unauthorized access to sensitive information, potentially resulting in the full disclosure of database contents or other unauthorized data manipulation [1].

Mitigation

While initial reports suggested updating to version 1.5.2 or later [1], the plugin is currently listed as abandoned, and the latest available version on the WordPress repository is 1.5.3 [2]. Users are strongly advised to uninstall the plugin immediately and replace it with an actively maintained alternative, as no reliable security updates are being provided [2].