CVE-2026-18473: WP Directory Kit SQL Injection Vulnerability

CVE-2026-18473 Overview

CVE-2026-18473 is an unauthenticated SQL injection vulnerability in the WP Directory Kit WordPress plugin versions prior to 1.5.5. The plugin fails to sanitise and escape a user-controlled parameter before including it in a SQL statement. Attackers can inject arbitrary SQL syntax over the network without authentication or user interaction. Successful exploitation allows extraction of sensitive data from the WordPress database, including user credentials, session tokens, and post metadata. The flaw is categorised under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the WordPress database, exposing credentials and stored content across every affected site.

Affected Products

WP Directory Kit WordPress plugin versions before 1.5.5
WordPress sites with the vulnerable plugin installed and active
Any hosting environment exposing the plugin's endpoints to the internet

Discovery Timeline

2026-08-09 - CVE-2026-18473 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-18473

Vulnerability Analysis

The vulnerability resides in a request handler exposed by WP Directory Kit that accepts a parameter and passes it into a SQL statement without escaping or parameterisation. Because the endpoint is reachable without authentication, any remote client can send crafted input. The WPScan advisory confirms the injection is triggered through a parameter used directly inside a SQL query.

An attacker can pivot from data extraction to full site takeover by dumping the wp_users table and cracking hashed passwords. Session tokens stored in wp_usermeta provide an alternative path to hijack administrator accounts without cracking. The impact scope is limited to the database, but WordPress administrator access typically leads to remote code execution through plugin or theme editing.

Root Cause

The root cause is direct string concatenation of untrusted input into a SQL query. WordPress provides $wpdb->prepare() for parameterised queries, but the affected code path bypasses it. This pattern is classified as CWE-89.

Attack Vector

Exploitation requires only network access to the WordPress site. The attacker sends an HTTP request to the vulnerable plugin endpoint with a SQL payload in the affected parameter. No user privileges or interaction are required, and the attack works against default installations of the plugin.

A working exploit has not been publicly published at the time of writing. Refer to the WPScan Vulnerability Advisory for authoritative technical details.

Detection Methods for CVE-2026-18473

Indicators of Compromise

HTTP requests to WP Directory Kit endpoints containing SQL keywords such as UNION, SELECT, SLEEP(, or information_schema
Unusual admin-ajax.php or plugin-specific action calls with encoded quotes, comments (--, #), or hex-encoded payloads
Spikes in database query errors logged by WordPress or the underlying MySQL/MariaDB instance
Unexpected outbound traffic from the web server following anomalous request patterns

Detection Strategies

Inspect web server access logs for requests targeting WP Directory Kit action names with suspicious parameter values
Deploy web application firewall rules that flag SQL metacharacters in plugin parameters
Correlate HTTP request patterns with wp_users or wp_options read anomalies at the database layer
Monitor for time-based blind SQL injection signatures using request latency baselines

Monitoring Recommendations

Enable verbose logging of plugin AJAX and REST endpoints and forward logs to a centralised analytics platform
Alert on newly created administrator accounts or modified wp_options entries following suspicious HTTP activity
Track outbound connections from the web tier to detect post-exploitation command-and-control traffic

How to Mitigate CVE-2026-18473

Immediate Actions Required

Upgrade WP Directory Kit to version 1.5.5 or later on every WordPress site where it is installed
Audit administrator accounts and force password resets if signs of database access are present
Rotate WordPress secret keys in wp-config.php to invalidate stolen session cookies
Review database logs for evidence of data exfiltration since the plugin was installed

Patch Information

The vendor addressed the vulnerability in WP Directory Kit 1.5.5. Site administrators should update through the WordPress plugin dashboard or by replacing the plugin files manually. Confirm the installed version after upgrade using the Plugins screen or WP-CLI (wp plugin list). See the WPScan Vulnerability Advisory for the fixed version reference.

Workarounds

Deactivate and remove the WP Directory Kit plugin until it can be updated to 1.5.5
Restrict access to the plugin's endpoints using a web application firewall rule that blocks SQL metacharacters
Place the WordPress admin surface behind IP allowlisting or an authenticating reverse proxy to reduce exposure
Enforce least-privilege database credentials for the WordPress user to limit the blast radius of successful injection

bash

# Configuration example: WP-CLI upgrade path
wp plugin update wp-directory-kit --version=1.5.5
wp plugin list --name=wp-directory-kit --fields=name,status,version