CVE-2026-18230: WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via section Parameter
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18230?
The severity of CVE-2026-18230 is rated at 65, indicating a medium risk.
How do I fix CVE-2026-18230?
To fix CVE-2026-18230, upgrade the WP Directory Kit plugin to version 1.5.6 or later.
What type of vulnerability is CVE-2026-18230?
CVE-2026-18230 is an SQL Injection vulnerability that affects the WP Directory Kit plugin.
Who is affected by CVE-2026-18230?
CVE-2026-18230 affects any authenticated users of the WP Directory Kit plugin prior to version 1.5.6.
How can CVE-2026-18230 be exploited?
CVE-2026-18230 can be exploited through an authenticated AJAX action that lacks proper authorization, allowing SQL injection attacks.