CVE-2026-18230: WP Directory Kit SQL Injection Vulnerability

CVE-2026-18230 Overview

CVE-2026-18230 is a SQL injection vulnerability in the WP Directory Kit WordPress plugin before version 1.5.6. The plugin fails to sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions. The affected AJAX endpoint also lacks a proper authorization check, allowing any authenticated user, including low-privileged Subscriber accounts, to execute arbitrary SQL queries against the WordPress database.

Critical Impact
Any authenticated user, including Subscribers, can inject arbitrary SQL and extract or modify sensitive database contents such as user credentials, session tokens, and site configuration.

Affected Products

WP Directory Kit WordPress plugin versions prior to 1.5.6
WordPress installations with the vulnerable plugin active
Sites permitting user registration at the Subscriber role or higher

Discovery Timeline

2026-08-12 - CVE-2026-18230 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18230

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] in an authenticated AJAX handler exposed by the WP Directory Kit plugin. User-supplied input reaches a SQL statement without sanitization or use of prepared statements. Because WordPress AJAX actions execute in the context of the authenticated user, and the vulnerable handler does not enforce role or capability checks, the attack surface extends to every registered account.

Exploitation requires only a valid WordPress session. On sites with open registration, an attacker can create a Subscriber account and immediately reach the vulnerable endpoint. Successful injection exposes the full WordPress database, enabling extraction of wp_users password hashes, session tokens stored in wp_usermeta, and secret keys used for authentication cookies.

Root Cause

The root cause is twofold. First, the plugin concatenates a request parameter directly into a SQL query rather than binding it via $wpdb->prepare(). Second, the AJAX action handler omits a current_user_can() capability check, so the authorization decision defaults to "any logged-in user." The combination converts a low-privilege account into a database-level compromise vector.

Attack Vector

The attack vector is network-based via authenticated HTTP requests to wp-admin/admin-ajax.php. An attacker submits a crafted parameter to the vulnerable AJAX action with a valid session cookie. The injected payload executes within the query context, permitting UNION-based extraction, boolean-based inference, or time-based blind injection against the underlying MySQL or MariaDB backend.

Refer to the WPScan Vulnerability Report #15789 for the specific vulnerable action name and parameter details.

Detection Methods for CVE-2026-18230

Indicators of Compromise

Requests to /wp-admin/admin-ajax.php containing SQL metacharacters such as UNION SELECT, SLEEP(, BENCHMARK(, or information_schema in POST bodies.
Unexpected new administrator accounts appearing in wp_users after Subscriber account activity.
Elevated database query latency correlated with authenticated AJAX requests from low-privilege accounts.
Web server logs showing repeated admin-ajax.php POSTs from the same session with varying payload lengths.

Detection Strategies

Enable and review WordPress plugin audit logs to correlate AJAX action invocations with user roles.
Deploy a web application firewall rule that flags SQL keywords in admin-ajax.php POST parameters targeting WP Directory Kit actions.
Query the WordPress database for unexpected schema reads or high-volume SELECT patterns originating from PHP-FPM workers.

Monitoring Recommendations

Alert on any Subscriber-role session issuing more than a baseline number of admin-ajax.php requests within a short window.
Monitor for creation of new users, changes to user_roles, and modifications to wp_options keys such as siteurl and active_plugins.
Forward WordPress access logs and MySQL general query logs to a centralized SIEM for correlation and retention.

How to Mitigate CVE-2026-18230

Immediate Actions Required

Update WP Directory Kit to version 1.5.6 or later on all WordPress sites.
Audit the wp_users table for unauthorized accounts and rotate all administrator passwords.
Rotate WordPress salts in wp-config.php to invalidate any stolen authentication cookies.
Review Subscriber and Contributor accounts and disable those that are not required.

Patch Information

The vendor addressed the vulnerability in WP Directory Kit version 1.5.6 by adding parameter sanitization and an authorization check on the affected AJAX action. See the WPScan Vulnerability Report #15789 for advisory details and remediation guidance.

Workarounds

Deactivate the WP Directory Kit plugin until the update to 1.5.6 can be applied.
Disable open user registration by unchecking "Anyone can register" under WordPress General Settings.
Deploy a WAF rule to block SQL metacharacters in POST parameters sent to the vulnerable AJAX action.
Restrict /wp-admin/admin-ajax.php access by IP allowlist where feasible for administrative environments.

bash

# Update WP Directory Kit via WP-CLI
wp plugin update wp-directorykit --version=1.5.6

# Verify installed version
wp plugin get wp-directorykit --field=version

# Disable open registration as a temporary hardening step
wp option update users_can_register 0