CVE-2026-96653: WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'displayname' Profile Field (Second-Order) in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Subscriber stores a displayname containing a single quote via their own profile, which WordPress preserves verbatim; the payload is then triggered when WdkCachedUserEditor::updatelistingsusereditor() re-reads that stored value and passes it unsanitized to the SQL sink.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. They can store a malicious value in their own display_name profile field; no user interaction is required.
When is the injected value executed?
This is a second-order injection: the payload is stored first and is triggered later when WdkCachedUserEditor::update_listings_user_editor() reads the saved display_name and passes it to the SQL query.
What could an attacker obtain?
The issue can be used to extract sensitive information from the WordPress database through time-based SQL injection. The provided data does not indicate impact to integrity or availability.
How can I check for possible exploitation?
Review Subscriber and other low-privilege user profiles for display_name values containing a single quote or other unexpected SQL-like content. Also investigate activity associated with updates processed by WdkCachedUserEditor::update_listings_user_editor().