WP Directory Kit

Through 1.5.4, a user with the custom-level role described by the record can influence order_by without adequate query preparation, enabling blind SQL injection and database information extraction. The export does not identify the role's capabilities, request route, handler or query structure; it does not establish unauthenticated exploitation. No fixed release is confirmed in the export, and the official plugin lookup was unavailable.

WP Directory Kit through 1.5.7 returns listing content through a public AJAX action without checking the listing's status or ownership. An unauthenticated attacker can request another user's draft or unapproved listing and read content that should not be public. The authoritative export does not name the AJAX action, listing selector parameter, request method, or handler function, and supplies no CVSS score or confirmed fixed release.

WP Directory Kit through 1.5.7 uses insufficiently sanitized widget settings in a SQL statement. An authenticated user with access to the page builder, requiring Editor-level access or higher, can store attacker-controlled values that alter the query when the affected page is rendered. This provides a database-access primitive; the export does not establish the particular data that can be read or modified, query type, widget name, setting keys, save endpoint, or query function. It provides no CVSS score or confirmed fixed release.

WP Directory Kit through 1.5.7 fails to check authorization and listing visibility in one of its shortcodes. An authenticated Contributor or higher can use that shortcode to disclose non-public content belonging to other users, including password-protected and hidden listing fields. Attacker-controlled shortcode use reaches a listing renderer that does not enforce the viewer's access to the requested content. The authoritative export does not identify the shortcode, selector attributes, rendering function, or a confirmed fixed version, and supplies no CVSS score.

WP Directory Kit before 1.5.7 performs no authorization check on a public AJAX action and returns unfiltered database rows. An unauthenticated caller can use it to retrieve usernames and email addresses belonging to users who hold the plugin's own roles.

WP Directory Kit before 1.5.7 uses the Administrator-controlled section parameter in an affected database query without adequate preparation. An Administrator can inject SQL and read database information; on multisite, a subsite administrator can use the flaw to cross site boundaries and read network-wide data.

WP Directory Kit through 1.5.4 has an unauthenticated, low-complexity SQL-injection issue. Crafted directory input can reach an SQL operation without adequate neutralization, with high confidentiality and low availability impact. Version 1.5.5 is fixed.

WP Directory Kit through 1.5.4 has an unauthenticated SQL-injection issue scored with high attack complexity. Crafted directory input can reach an SQL operation without adequate neutralization, with high confidentiality and low availability impact. Version 1.5.5 is fixed.

WP Directory Kit before 1.5.6 passes public search_location or search_category values to wdk_treefield_select_ajax() when a non-default category or location search-field type is configured. Version 1.5.5 collects the selected values and interpolates their comma-joined IDs into SQL IN(...) and FIELD(...) clauses without integer conversion. An unauthenticated attacker can inject SQL and extract database information. Version 1.5.6 casts every selected item to an integer before building the query.

WP Directory Kit before 1.5.6 registers the authenticated wp_ajax_wdk_admin_action action. Its dispatcher accepts page=wdk_fields without a capability check, allowing a Subscriber to reach Wdk_fields::field_edit(). That method uses the posted section value while updating field section and order data, producing SQL injection. Version 1.5.6 adds an Administrator-only controller guard.

WP Directory Kit 1.5.4 and earlier does not sanitize and escape an attacker-controlled parameter before placing it in a SQL statement, allowing unauthenticated SQL injection. Version 1.5.5 is the fixed release.

WP Directory Kit before 1.5.5 registers wp_ajax_wdk_admin_action for authenticated users. Wpdirectorykit_Admin::ajax_admin() accepts the POST page and function values and passes them to Winter_MVC_WDK->load_controller() without a capability check or nonce. A Subscriber can select an affected controller operation and disclose WordPress users and unpublished listing content. Version 1.5.5 restricts the allowed page value.

WP Directory Kit before 1.5.5 registers wp_ajax_wdk_admin_action for authenticated users. Wpdirectorykit_Admin::ajax_admin() accepts the POST page and function values and passes them to Winter_MVC_WDK->load_controller() without a capability check or nonce. A Subscriber can select an affected controller operation and retrieve plugin settings, including API keys and other stored secrets. Version 1.5.5 restricts the allowed page value.

WP Directory Kit before 1.5.5 registers wp_ajax_wdk_admin_action for authenticated users. Wpdirectorykit_Admin::ajax_admin() accepts the POST page and function values and passes them to Winter_MVC_WDK->load_controller() without a capability check or nonce. A Subscriber can select an affected controller operation and retrieve private contact messages and associated user data. Version 1.5.5 restricts the allowed page value.

WP Directory Kit before 1.5.5 registers wp_ajax_wdk_admin_action for authenticated users. Wpdirectorykit_Admin::ajax_admin() accepts the POST page and function values and passes them to Winter_MVC_WDK->load_controller() without a capability check or nonce, allowing a Subscriber to reach a SQL-injection path. Version 1.5.5 restricts the allowed page value.

WP Directory Kit is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 1.5.0.

WP Directory Kit is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 1.5.1.

WP Directory Kit is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 1.5.0.

WP Directory Kit is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WP Directory Kit is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.

WP Directory Kit is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP Directory Kit is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WP Directory Kit is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

WP Directory Kit is affected by SQL injection. Exploitation requires an authenticated subscriber account. A successful request can alter database queries and expose or modify WordPress data.

WP Directory Kit is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

WP Directory Kit is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.

WP Directory Kit is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

WP Directory Kit is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP Directory Kit is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

WP Directory Kit is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

WP Directory Kit is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.