CVE-2026-16588

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5

Description The plugin is susceptible to blind SQL Injection, a technique that allows an attacker to infer data from a database by observing the application's response to specific queries. The issue occurs because the order by parameter is not properly escaped and the SQL query is not sufficiently prepared. Authenticated attackers with custom-level access or higher can append malicious SQL queries to extract sensitive information from the database.

Recommendations Update the plugin to version 1.5.5 or later. As a temporary mitigation, restrict access to the functionality utilizing the order by parameter for users with custom-level access.