CVE-2026-18474 Overview
CVE-2026-18474 is a SQL injection vulnerability [CWE-89] affecting the WP Directory Kit WordPress plugin in versions prior to 1.5.6. The plugin fails to sanitize and escape a user-supplied parameter before including it in a SQL statement. Unauthenticated attackers can exploit the flaw when a non-default search field type is configured on the affected site. Successful exploitation allows arbitrary SQL query execution against the WordPress database, exposing sensitive stored data such as user records, hashed credentials, and configuration values.
Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL queries and extract confidential data from WordPress databases running vulnerable WP Directory Kit installations.
Affected Products
- WP Directory Kit WordPress plugin, all versions prior to 1.5.6
- WordPress installations with a non-default search field type configured
- Any site exposing the plugin's search functionality to unauthenticated visitors
Discovery Timeline
- 2026-08-12 - CVE-2026-18474 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-18474
Vulnerability Analysis
The vulnerability resides in the WP Directory Kit plugin's search handling logic. A request parameter used by the search feature is concatenated into a SQL query without prior sanitization or parameter binding. When the site administrator configures a non-default search field type, the vulnerable code path becomes reachable by unauthenticated users. Attackers can supply crafted values that break out of the intended query context and append arbitrary SQL clauses.
Because exploitation requires no authentication and only network access, the flaw is exposed on any public-facing WordPress site running the affected plugin configuration. The CVSS scope is marked as Changed, indicating that the impact extends beyond the plugin boundary into the underlying database.
Root Cause
The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin builds SQL statements through string concatenation rather than prepared statements or the WordPress $wpdb->prepare() API. This anti-pattern allows attacker-controlled input to alter query semantics.
Attack Vector
An unauthenticated attacker sends an HTTP request to the WordPress site containing a malicious payload in the affected search parameter. The plugin passes the tainted value directly into a SQL query. Typical exploitation techniques include UNION-based extraction, boolean-based blind injection, and time-based blind injection to read arbitrary tables such as wp_users and wp_options.
No verified proof-of-concept code is publicly available. See the WPScan Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2026-18474
Indicators of Compromise
- HTTP requests to WP Directory Kit endpoints containing SQL meta-characters such as ', UNION SELECT, SLEEP(, BENCHMARK(, or information_schema
- Unusually long response times on search requests, suggesting time-based blind SQL injection
- Web server logs showing repeated automated requests to plugin search parameters from single source IPs
- Unexpected read access patterns against the wp_users or wp_usermeta tables
Detection Strategies
- Deploy WAF signatures targeting SQL injection payloads directed at WordPress plugin request paths
- Enable MySQL query logging and alert on queries referencing information_schema originating from the WordPress application user
- Correlate web access logs with database query logs to identify tainted parameter flow into SQL statements
Monitoring Recommendations
- Monitor WordPress error logs for database syntax errors, which indicate injection probing
- Track outbound data volume from web servers to detect bulk extraction attempts
- Alert on newly created administrator accounts or unexpected changes in wp_options values
How to Mitigate CVE-2026-18474
Immediate Actions Required
- Upgrade the WP Directory Kit plugin to version 1.5.6 or later on all WordPress sites
- Audit plugin configuration and temporarily revert search field type to default if patching is delayed
- Review database logs and WordPress audit trails for signs of prior exploitation
- Rotate WordPress administrator credentials and any secrets stored in wp_options if compromise is suspected
Patch Information
The vendor addressed the vulnerability in WP Directory Kit version 1.5.6 by properly sanitizing and escaping the affected search parameter before use in SQL statements. Refer to the WPScan Vulnerability Advisory for advisory details and fix confirmation.
Workarounds
- Deactivate the WP Directory Kit plugin until an upgrade to 1.5.6 or later is applied
- Reconfigure the plugin to use the default search field type, which does not reach the vulnerable code path
- Restrict access to plugin search endpoints via WAF rules or IP allowlisting where feasible
# Configuration example: upgrade the plugin via WP-CLI
wp plugin update wp-directory-kit --version=1.5.6
wp plugin list --name=wp-directory-kit
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
