WP Directory Kit: SQL injection via 'main_field' parameter
Summary
The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape the 'main_field' parameter before using it in an SQL statement. A logged-in user with the custom Listing Admin role or a higher role can exploit this to run SQL injection attacks, which may expose database content such as user or customer data. Anonymous internet users cannot exploit it directly. Scoring is conflicting: the supplied record shows CVSS 6.8, VulDB lists 4.7, and NVD has not yet scored the CVE.
Affected
- WP Directory Kit versions before 1.6.3 (CVE record: 0 to before 1.6.3; VulDB: up to 1.6.2)
Fixed in
- Version 1.6.3 or later
Workaround
- No vendor-documented workaround.
- If an update is not possible at once: review who holds the custom Listing Admin role and remove it from accounts that do not need it, or temporarily deactivate the plugin.
Exploitation
- Not listed in CISA KEV.
- No public exploit code or proof of concept found as of 11 Nov 2026.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
Our recommendation
- Check the installed plugin version now and update to 1.6.3 or later.
- Review and reduce accounts with the Listing Admin role or higher, and enforce strong passwords and multi-factor authentication for them.
- Check the site logs for unusual database queries or access by these accounts.
- Check whether the related 1.6.x fixes are also applied, as older sites may be exposed to further SQL injection issues in this plugin.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- CVE Record CVE-2026-118420 www.cve.org
- VulDB entry 435654 vuldb.com
- OffSeq Threat Radar radar.offseq.com
- OpenCVE CVE-2026-118420 app.opencve.io
- Patchstack advisory for CVE-2026-109197 (related 1.6.0 issue) patchstack.com
- WordPress.org plugin page en-ca.wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:34.
Original description (NVD)
The WP Directory Kit WordPress plugin before 1.6.3 does not sanitise and escape a parameter before using it in a SQL statement, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.