CVE-2026-14785: Web Directory Free WordPress SQLi Flaw

CVE-2026-14785 Overview

CVE-2026-14785 is a SQL Injection vulnerability [CWE-89] in the Web Directory Free plugin for WordPress. The flaw affects all versions up to and including 1.7.13. It resides in the handling of the levels parameter, where user input is insufficiently escaped and the underlying SQL query lacks proper preparation. Unauthenticated attackers can append arbitrary SQL fragments to existing queries and extract sensitive data from the WordPress database. Public references include the Wordfence Vulnerability Report and the plugin source in ajax_controller.php and frontend_controller.php.

Critical Impact
Unauthenticated network attackers can extract sensitive data — including credentials, session tokens, and personally identifiable information — from the WordPress database.

Affected Products

Web Directory Free plugin for WordPress, all versions up to and including 1.7.13
WordPress sites running the vulnerable plugin with front-end directory features enabled
Any hosting environment exposing the plugin's AJAX endpoints to unauthenticated traffic

Discovery Timeline

2026-07-28 - CVE-2026-14785 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-14785

Vulnerability Analysis

The vulnerability is a generic SQL Injection [CWE-89] triggered through the levels request parameter. The plugin passes the parameter value into a SQL query without sufficient escaping and without using prepared statements. As a result, attacker-supplied SQL syntax is concatenated directly into the executed query. Because the affected endpoints do not require authentication, exploitation requires no valid WordPress account or user interaction. The primary impact is confidentiality: attackers can read arbitrary rows and columns accessible to the WordPress database user, including entries in wp_users and wp_usermeta.

Root Cause

The root cause is missing input sanitization combined with unprepared SQL query construction in the plugin's controllers. Code paths in ajax_controller.php and frontend_controller.php accept the levels parameter and interpolate it into SQL statements without calling $wpdb->prepare() or applying escaping helpers such as esc_sql(). This violates WordPress secure-coding guidance for database access.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request over the network to a vulnerable endpoint exposing the levels parameter. The attacker embeds a UNION-based or boolean-based SQL payload, which the plugin appends to its query. The database returns attacker-controlled projections or reveals data through inferential techniques, enabling extraction of password hashes, session tokens, and configuration secrets.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report and the plugin source review for the vulnerable code locations.

Detection Methods for CVE-2026-14785

Indicators of Compromise

HTTP requests to the plugin's AJAX or front-end endpoints containing SQL syntax in the levels parameter, such as UNION SELECT, SLEEP(, INFORMATION_SCHEMA, or comment sequences like -- and /*.
Unusual admin-ajax.php traffic referencing Web Directory Free actions from unauthenticated sessions.
Database error messages or elevated query latency logged around requests carrying the levels parameter.

Detection Strategies

Inspect web server access logs for GET or POST requests where the levels parameter contains non-numeric characters or SQL keywords.
Deploy WAF rules that identify SQL Injection patterns targeting WordPress plugin endpoints, especially unauthenticated ones.
Correlate spikes in database read volume with requests to Web Directory Free routes to identify data exfiltration attempts.

Monitoring Recommendations

Enable MySQL general or slow query logging temporarily to capture anomalous queries originating from the plugin.
Alert on outbound responses from vulnerable endpoints that contain unusually large payloads, indicating bulk data extraction.
Track file integrity of plugin files under wp-content/plugins/web-directory-free/ to detect tampering or backdoor insertion after exploitation.

How to Mitigate CVE-2026-14785

Immediate Actions Required

Deactivate the Web Directory Free plugin on any WordPress site running version 1.7.13 or earlier until a patched release is installed.
Restrict access to admin-ajax.php and the plugin's front-end routes at the WAF or reverse proxy where feasible.
Rotate WordPress administrator passwords, API keys, and secret keys defined in wp-config.php if exploitation is suspected.

Patch Information

At the time of publication, the enriched data does not list a fixed version. Monitor the WordPress plugin repository and the Wordfence advisory for a version superseding 1.7.13. Update immediately once released and verify the plugin no longer accepts unsanitized input in the levels parameter.

Workarounds

Add a WAF rule that blocks or normalizes requests where the levels parameter is not strictly numeric.
Enforce least privilege on the WordPress database user, removing permissions such as FILE, CREATE, and cross-database SELECT to limit blast radius.
Replace the plugin with an actively maintained alternative if a patch is not released in a timely fashion.

bash

# Example ModSecurity rule to block non-numeric 'levels' parameter values
SecRule ARGS:levels "!@rx ^[0-9]+$" \
    "id:1026147850,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'CVE-2026-14785: Suspicious levels parameter blocked'"