CVE-2026-18653 WP Directory Kit CVE debrief

Who should care

Administrators of WordPress installations using the WP Directory Kit plugin should be aware of this vulnerability and take steps to mitigate it. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. This vulnerability lets an administrator of a single site read data belonging to the entire network on a multisite installation. The vulnerability is caused by a lack of input sanitisation and escaping in the plugin's SQL statements. The official CVE Program record and NVD entry provide source-provided CVE metadata and vulnerability assessment.

Defensive priority

Administrators should prioritize updating the WP Directory Kit WordPress plugin to version 1.5.7 or later to prevent SQL injection attacks.

Recommended defensive actions

• Update the WP Directory Kit WordPress plugin to version 1.5.7 or later
• Implement SQL injection prevention measures
• Monitor for suspicious SQL activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide evidence of the vulnerability in the WP Directory Kit WordPress plugin. However, further details about the vulnerability and its impact are limited. The WP Directory Kit plugin before version 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation, this lets an administrator of a single site read data belonging to the entire network, which they are not otherwise able to reach. The official CVE Program record and NVD entry provide source-provided CVE metadata and vulnerability assessment. However, defenders should verify the affected scope, severity, and vendor guidance through official advisories or CVE records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.