CVE-2026-18474: WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WP Directory Kitto a version that resolves this vulnerability.Fixed in 1.5.6 - Compensating control
If immediate upgrade is not possible, restrict access to the WordPress endpoint(s) that accept the WP Directory Kit search parameters (e.g., prevent unauthenticated requests to search_location/search_category) using web/application firewall rules or network access controls until the plugin is updated to 1.5.6 or later.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18474?
CVE-2026-18474 has a risk score of 71, indicating a high severity vulnerability.
How do I fix CVE-2026-18474?
To fix CVE-2026-18474, update the WP Directory Kit plugin to version 1.5.6 or later.
What type of attack does CVE-2026-18474 enable?
CVE-2026-18474 allows for unauthenticated SQL injection attacks via the search_location and search_category parameters.
Who is affected by CVE-2026-18474?
Any website using the WP Directory Kit plugin version before 1.5.6 is affected by CVE-2026-18474.
What are the consequences of exploiting CVE-2026-18474?
Exploiting CVE-2026-18474 can allow attackers to execute arbitrary SQL queries, potentially leading to data breaches.