PT-2025-51043
CVE-2025-13089
·
Published
2025-12-12
·
Updated
2025-12-18
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
WP Directory Kit versions prior to 1.4.8
Description
The WP Directory Kit plugin for WordPress is susceptible to SQL Injection through the
hide fields and attr search parameter. Insufficient input sanitization and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database.Recommendations
Update WP Directory Kit to version 1.4.8 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾