CVE-2026-118421: WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter

Q: Which users can exploit this issue?

Exploitation requires an authenticated user with the WP Directory Kit custom Listing Admin role or a higher-privileged role. Unauthenticated users and users below that role are not identified as able to exploit it.

Q: Is an immediate upgrade required for all affected installations?

Installations using WP Directory Kit versions before 1.6.3 are affected when users hold the Listing Admin role or greater privileges. Upgrade the plugin to 1.6.3 or later to address the vulnerable handling of the order_by parameter.

Q: What can be done if the plugin cannot be updated immediately?

Restrict assignment of the WP Directory Kit Listing Admin role and higher privileges to trusted users, since those roles are required for exploitation. Review existing users with those roles and remove unnecessary access.

Published Nov 12, 2026

Updated

The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on one of its admin screens before using it in a SQL statement, relying on a keyword deny-list whose replacement order can be bypassed, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks.

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Exploitation requires an authenticated user with the WP Directory Kit custom Listing Admin role or a higher-privileged role. Unauthenticated users and users below that role are not identified as able to exploit it.

Is an immediate upgrade required for all affected installations?

Installations using WP Directory Kit versions before 1.6.3 are affected when users hold the Listing Admin role or greater privileges. Upgrade the plugin to 1.6.3 or later to address the vulnerable handling of the order_by parameter.

What can be done if the plugin cannot be updated immediately?

Restrict assignment of the WP Directory Kit Listing Admin role and higher privileges to trusted users, since those roles are required for exploitation. Review existing users with those roles and remove unnecessary access.

CVE-2026-118421: WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter

Event History

Frequently Asked Questions

Which users can exploit this issue?

Is an immediate upgrade required for all affected installations?

What can be done if the plugin cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

Is an immediate upgrade required for all affected installations?

What can be done if the plugin cannot be updated immediately?