CVE-2026-118421
WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on one of its admin screens before using it in a SQL statement, relying on a keyword deny-list whose replacement order can be bypassed, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks.
| Vendor | unknown |
| Product | wp directory kit |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp directory kit
Be the first to know when new unknown vulnerabilities affecting unknown wp directory kit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Directory Kit
0 < 1.6.3
References
Credits
anhdung1329 WPScan