CVE-2026-16589

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5

Description An issue exists where a parameter is not sanitized or escaped before being used in a SQL statement. This occurs through an authenticated AJAX action that lacks authorization and nonce checks, enabling any authenticated user, including those with Subscriber privileges, to perform SQL injection attacks. The vulnerable parameter is data fields list.

Recommendations Update WP Directory Kit to version 1.5.5 or later.