CVE-2026-96653

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.6.0

Description Authenticated users with subscriber-level access and above can perform a time-based second-order SQL Injection. This occurs when a user stores a specially crafted value in the display name profile field, which is preserved by WordPress. The issue is triggered when the WdkCachedUserEditor::update listings user editor() function re-reads this stored value and passes it unsanitized to a SQL sink, allowing attackers to append additional queries and extract sensitive information from the database. A second-order injection is a type of vulnerability where the malicious input is stored by the application and later executed in a different part of the system.

Recommendations Update to a version newer than 1.5.9.