CVE-2026-39531 Wp Directory Kit CVE debrief

Who should care

Administrators and security teams responsible for WordPress sites running WP Directory Kit, especially environments that expose the plugin to untrusted web traffic. Managed hosting providers and incident response teams should also review exposure because the CVSS vector indicates network-based, unauthenticated access.

Technical summary

The source corpus describes an Improper Neutralization of Special Elements used in an SQL Command (CWE-89) issue leading to blind SQL injection in WP Directory Kit, affecting versions from n/a through 1.5.0. The NVD record lists the attack vector as network-based with no privileges or user interaction required, and the CVSS scope is changed, with high confidentiality impact and low availability impact. No exploit details are provided in the supplied sources, so assessment should remain limited to the documented injection class and affected version range.

Defensive priority

High. The combination of critical severity, unauthenticated network exposure, and database-related impact warrants prompt verification of affected installations and immediate remediation planning.

Recommended defensive actions

• Confirm whether WP Directory Kit is installed anywhere in your WordPress estate and identify all versions in use.
• Treat versions through 1.5.0 as affected until validated otherwise.
• Review the linked Patchstack advisory for vendor guidance, upgrade information, or mitigations.
• Apply the vendor-recommended fix or remove the plugin from exposed systems if no safe update is available.
• Restrict access and monitor for anomalous database queries or unusual application behavior while remediation is underway.
• Reassess after patching to ensure no remaining instances of the affected plugin version exist.

Evidence notes

Evidence is limited to the NVD CVE record and a single Patchstack reference URL. NVD describes the issue as blind SQL injection (CWE-89), assigns CVSS 3.1 9.3, and marks the vuln status as Deferred. The vendor field in the supplied data is low confidence and should not be treated as authoritative without further validation from the linked advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.