CVE-2026-16589 Overview
CVE-2026-16589 is a SQL injection vulnerability in the WP Directory Kit WordPress plugin before version 1.5.5. The plugin exposes an authenticated AJAX action that fails to sanitize and escape a user-supplied parameter before including it in a SQL statement. The affected action also lacks authorization and nonce checks. Any authenticated user, including a low-privilege Subscriber, can inject arbitrary SQL and read sensitive database contents. The flaw is tracked as CWE-89: SQL Injection.
Critical Impact
Authenticated Subscriber-level users can execute arbitrary SQL against the WordPress database, exposing user credentials, session tokens, and other sensitive data.
Affected Products
- WP Directory Kit WordPress plugin versions before 1.5.5
- WordPress sites permitting Subscriber-level or higher registration with the plugin installed
- Any WordPress deployment running vulnerable WP Directory Kit releases
Discovery Timeline
- 2026-08-08 - CVE-2026-16589 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-16589
Vulnerability Analysis
The vulnerability resides in an authenticated AJAX handler exposed by WP Directory Kit. The handler receives a request parameter and concatenates it directly into a SQL query without sanitization or prepared statements. WordPress registers AJAX actions under the wp_ajax_{action} hook, which is reachable by any logged-in user regardless of role.
The handler compounds the issue by omitting two standard WordPress security controls. It does not call check_ajax_referer() to validate a nonce, so requests cannot be tied to a legitimate UI flow. It also does not verify the caller's capabilities with current_user_can(), so Subscribers reach the same code path as administrators. Both gaps are required for the SQL injection to be practical from a low-privilege account.
Successful exploitation lets an attacker read arbitrary tables in the WordPress database. Because the CVSS impact vector is scoped to confidentiality only, the primary risk is data theft rather than direct write or availability impact. Attackers commonly chain this class of flaw to extract wp_users password hashes and session cookies stored in wp_usermeta, then escalate to administrator through offline cracking or cookie replay.
Root Cause
The root cause is unsanitized parameter concatenation into a SQL statement, combined with missing authorization and nonce enforcement on the AJAX endpoint. The plugin does not use $wpdb->prepare() for parameterized queries.
Attack Vector
The attack vector is network-based over HTTP(S) against the admin-ajax.php endpoint. The attacker must hold any authenticated WordPress account, which on sites with open registration is trivially obtainable. No user interaction is required. Refer to the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-16589
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php from Subscriber accounts containing SQL keywords such as UNION, SELECT, SLEEP, or -- in parameter values
- Unusual outbound queries or long response times from admin-ajax.php correlated with the WP Directory Kit action name
- New or unexpected administrator accounts, password resets, or session token reuse following AJAX activity from low-privilege users
Detection Strategies
- Inspect web server access logs for authenticated admin-ajax.php calls invoking WP Directory Kit actions with encoded SQL syntax in query or body parameters
- Deploy WAF signatures for classic SQL injection payloads scoped to authenticated WordPress AJAX endpoints
- Enable MySQL general or slow query logging temporarily to identify malformed queries originating from the plugin's handler
Monitoring Recommendations
- Alert on any Subscriber account issuing more than a baseline number of admin-ajax.php requests within a short window
- Monitor the wp_users and wp_usermeta tables for unauthorized reads via database audit logging where available
- Track creation of new WordPress accounts followed by immediate AJAX activity, a common precursor to exploitation
How to Mitigate CVE-2026-16589
Immediate Actions Required
- Update the WP Directory Kit plugin to version 1.5.5 or later on all WordPress sites
- Audit existing user accounts and rotate credentials for any account showing suspicious AJAX activity
- Temporarily disable the plugin if patching cannot be performed within your maintenance window
Patch Information
The vendor addressed the flaw in WP Directory Kit version 1.5.5 by adding proper input sanitization, prepared statements, and authorization plus nonce validation on the affected AJAX action. See the WPScan Vulnerability Report for confirmation of the fixed version.
Workarounds
- Disable open user registration in WordPress general settings to reduce the pool of authenticated attackers
- Restrict access to /wp-admin/admin-ajax.php at the WAF layer for unauthenticated or non-privileged users where feasible
- Deactivate WP Directory Kit until the site can be upgraded to a fixed release
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
