CVE-2026-118420: WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'main_field' Parameter
Published Nov 11, 2026
·Updated
The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL statement, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks.
Affected Software
1 affected component
WP Directory Kit WP Directory Kit WordPress plugin<1.6.3
Event History
Nov 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
Which users can exploit this issue?
Exploitation requires a user account assigned the plugin's custom Listing Admin role or a higher-privileged role. Unauthenticated and lower-privileged users are not identified as able to exploit it.
2
Are installations running version 1.6.3 affected?
The issue affects versions before 1.6.3. Version 1.6.3 and later are not described as affected.
3
What input is involved in the SQL injection?
The vulnerable input is the main_field parameter, which is used in a SQL statement without adequate sanitization and escaping.