by Kastro
Paper/Archive/CVE-2026-39531

CVE-2026-39531

Wp Directory Kit WP Directory Kit — WordPress WP Directory Kit plugin <= 1.5.0 - SQL Injection vulnerability

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
31
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 15.5.155 × 203.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wp Directory Kit WP Directory Kit allows Blind SQL Injection. This issue affects WP Directory Kit: from n/a through 1.5.0.

Affected

ProductAffectedFixed inSource
WP Directory Kitn/a – 1.5.0–CNA

Scores by source

Patchstack (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refpatchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-5-0-sql-injection-vulnerability?_s_id=cve