CVE-2026-16596

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5

Description The WP Directory Kit plugin for WordPress contains a SQL Injection flaw. Authenticated attackers with custom-level access or higher can exploit this by manipulating the data fields list parameter. The issue stems from insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query, allowing attackers to append malicious queries to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 1.5.4. As a temporary mitigation, restrict access to the data fields list parameter for users with custom-level permissions.