CVE-2026-14785

Name of the Vulnerable Software and Affected Versions Web Directory Free versions prior to 1.7.14

Description The Web Directory Free plugin for WordPress contains a generic SQL Injection flaw. This issue occurs because the software fails to properly escape user-supplied input and lacks sufficient preparation of the SQL query. Unauthenticated attackers can exploit this by appending malicious SQL queries via the levels parameter to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 1.7.13. As a temporary mitigation, restrict or disable the use of the levels parameter until the update is applied.