CVE-2026-16593: WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings
The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered.
Affected Software
Event History
Frequently Asked Questions
Which users could exploit this issue?
An authenticated user who has access to the page builder with Editor-level privileges or higher could exploit it. The vulnerable settings are in the Elementor Category and Location widgets.
When does the injected SQL execute?
The SQL injection executes when a page containing the affected widget configuration is rendered. This means a malicious widget setting may not execute until the relevant page is viewed or otherwise rendered.
Are unauthenticated visitors able to exploit this directly?
The available information identifies the attack as requiring authentication and page-builder access at Editor level or above. It does not indicate that an unauthenticated visitor can directly submit the vulnerable widget settings.