CVE-2025-13138: WP Directory Kit Plugin SQLi Vulnerability

CVE-2025-13138 Overview

CVE-2025-13138 is an unauthenticated SQL Injection vulnerability in the WP Directory Kit plugin for WordPress. The flaw affects all versions up to and including 1.4.3 and resides in the columns_search parameter handled by the select_2_ajax() function. The plugin fails to escape user-supplied input and does not properly prepare the SQL query, allowing attackers to append arbitrary SQL clauses to existing queries. Successful exploitation enables extraction of sensitive data from the WordPress database, including credentials, session tokens, and personally identifiable information stored in plugin tables.

Critical Impact
Unauthenticated attackers can extract sensitive database contents over the network without user interaction, including WordPress user hashes and configuration secrets.

Affected Products

WP Directory Kit plugin for WordPress, all versions up to and including 1.4.3
WordPress sites with the wpdirectorykit plugin installed and activated
Any environment exposing the affected AJAX endpoint to unauthenticated network traffic

Discovery Timeline

2025-11-21 - CVE-2025-13138 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13138

Vulnerability Analysis

The vulnerability is classified under CWE-89: Improper Neutralization of Special Elements used in an SQL Command. The select_2_ajax() function in Wdk_frontendajax.php accepts the columns_search parameter from HTTP requests and incorporates it directly into a SQL statement. Because the plugin does not use prepared statements with placeholders or sanitize the input through esc_sql() or $wpdb->prepare(), attackers can break out of the intended query context.

The endpoint is reachable through the standard WordPress AJAX handler at /wp-admin/admin-ajax.php, which serves both authenticated and unauthenticated users when the corresponding wp_ajax_nopriv_ action is registered. This makes the vulnerability exploitable without any credentials. The EPSS score of 10.688% places this vulnerability in the 93rd percentile, indicating elevated probability of exploitation activity.

Root Cause

The root cause is the concatenation of unsanitized user input into a SQL query string. WordPress provides the $wpdb->prepare() API specifically to bind parameters safely, but the affected code path bypasses this protection. The columns_search parameter is treated as trusted data and inserted into the query without escaping special SQL characters such as quotes, parentheses, or UNION keywords.

Attack Vector

An attacker sends a crafted HTTP POST request to admin-ajax.php invoking the plugin's select_2_ajax action. The columns_search parameter contains malicious SQL syntax — typically a UNION SELECT payload — that appends a secondary query to retrieve data from the wp_users or wp_options tables. Because the response is returned in the AJAX payload, attackers can read query results directly. Time-based and boolean-based blind SQL injection techniques are also applicable when results are not directly reflected.

For implementation specifics, see the WordPress Plugin Code Reference and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-13138

Indicators of Compromise

HTTP POST requests to /wp-admin/admin-ajax.php containing action=select_2_ajax and SQL metacharacters in the columns_search parameter, such as UNION, SELECT, SLEEP(, /*, or --.
Anomalous database errors in PHP or MySQL logs referencing the WP Directory Kit plugin tables.
Unexpected outbound traffic from the web server following requests to the vulnerable endpoint.
New or modified administrator accounts in wp_users following suspicious AJAX activity.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the columns_search parameter on select_2_ajax requests for SQL syntax tokens.
Enable WordPress query logging or MySQL general query log to identify queries containing concatenated payloads against plugin tables.
Monitor request frequency and response sizes to admin-ajax.php for patterns consistent with automated injection tooling such as sqlmap.

Monitoring Recommendations

Alert on repeated 200-status responses to admin-ajax.php with unusually large response bodies from a single source IP.
Track failed login attempts immediately following AJAX requests to the vulnerable action, which may indicate credential reuse from exfiltrated hashes.
Forward web server and database logs to a centralized SIEM for correlation across the WordPress stack.

How to Mitigate CVE-2025-13138

Immediate Actions Required

Update the WP Directory Kit plugin to a version newer than 1.4.3 as soon as a patched release is available from the vendor.
If no patch is yet available, deactivate and remove the plugin until a fix is released.
Review WordPress user accounts, application passwords, and API keys for unauthorized changes and rotate all administrator credentials.
Audit wp_options and plugin-specific tables for evidence of unauthorized read access.

Patch Information

The vendor changeset referenced in the advisory indicates code modifications to the affected controller. Administrators should consult the WordPress Plugin Changeset Log and the WordPress Plugin Overview page to confirm the fixed version and apply it immediately.

Workarounds

Block requests to /wp-admin/admin-ajax.php with action=select_2_ajax at the WAF or reverse proxy layer until the plugin is updated.
Apply input validation rules that reject the columns_search parameter when it contains SQL metacharacters or exceeds expected length.
Restrict access to the WordPress site to known IP ranges where feasible, particularly for staging and administrative environments.

bash

# Example ModSecurity rule to block SQL injection attempts against the vulnerable action
SecRule ARGS:action "@streq select_2_ajax" \
    "id:1013138,phase:2,chain,deny,status:403,log,\
    msg:'CVE-2025-13138 WP Directory Kit SQLi attempt'"
    SecRule ARGS:columns_search "@rx (?i)(union|select|sleep\(|benchmark\(|--|/\*)"