WordPress security changelog
MEDIUM CVE-2026-16593 Deferred

WP Directory Kit lets page-builder editors store SQL injection in widget settings

WP Directory Kit through 1.5.7 uses insufficiently sanitized widget settings in a SQL statement. An authenticated user with access to the page builder, requiring Editor-level access or higher, can store attacker-controlled values that alter the query when the affected page is rendered. This provides a database-access primitive; the export does not establish the particular data that can be read or modified, query type, widget name, setting keys, save endpoint, or query function. It provides no CVSS score or confirmed fixed release.

CVE / CNA score 6.8 CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD score Pending NVD has not published its own CVSS assessment.
Component
WP Directory Kit
Plugin slug
wpdirectorykit
Affected
<= 1.5.7
Safe version
See mitigation notes
Published
Sep 15, 2026
Weakness
CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

This CVE was published Sep 15, 2026 and is one of 31 known issues for this plugin.

What to do

Update, patch or deactivate.

No fixed release is confirmed, and the official WordPress.org changelog lookup was unavailable. Disable the affected plugin pending a vendor-confirmed fix and review untrusted page-builder widget settings. The application-level fix must use prepared SQL with placeholders for values, validate setting types, and allowlist any dynamic identifiers or query operators that cannot be parameterized. Restrict widget editing to authorized users; HTML escaping alone does not prevent SQL injection.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

Primary and upstream sources