CVE-2026-118421— WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter
Quick assessment
Affected
Unknown WP Directory Kit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 1.6.3 版本之前，WP Directory Kit WordPress 插件在其某个管理屏幕中，用于对结果进行排序的参数未经过适当的清理和转义，便直接用于 SQL 语句。该插件依赖一个关键词黑名单进行防护，但其替换顺序可被绕过。因此，拥有 WP Directory Kit 自定义"Listing Admin"角色及更高权限的用户，可利用此漏洞执行 SQL 注入攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118421
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order results on one of its admin screens before using it in a SQL statement, relying on a keyword deny-list whose replacement order can be bypassed, making it possible for users holding the WP Directory Kit WordPress plugin before 1.6.3's custom Listing Admin role, and above, to perform SQL injection attacks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Directory Kit | 0 ~ 1.6.3 | - |
|
II. Public POCs for CVE-2026-118421
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-118421
请登录查看更多情报信息。
Other References for CVE-2026-118421 (1)
-
https://wpscan.com/vulnerability/cb2c14ff-96bd-4731-bce2-346a904fc72b/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-11-12 · 21 CVEs total
| CVE-2026-121498 | Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR | |
| CVE-2026-110072 | Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attr | |
| CVE-2026-110041 | Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST E | |
| CVE-2026-106027 | Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion v | |
| CVE-2026-110959 | Descope < 1.2.0 - Unauthenticated Account Takeover | |
| CVE-2026-119039 | Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detecti | |
| CVE-2026-118531 | Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update | |
| CVE-2026-123044 | ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure | |
| CVE-2026-119040 | Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification | |
| CVE-2026-122003 | Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF | |
| CVE-2026-76792 | User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP L | |
| CVE-2026-123092 | WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Actio | |
| CVE-2026-124652 | Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR | |
| CVE-2026-124653 | Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure | |
| CVE-2026-124647 | TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie | |
| CVE-2026-124648 | TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key | |
| CVE-2026-124815 | Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions | |
| CVE-2026-124814 | Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 't | |
| CVE-2026-124817 | Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification | |
| CVE-2026-124665 | Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure v |
IV. Related Vulnerabilities
Same product: WP Directory Kit
-
CVE-2026-118418
WP Directory Kit < 1.6.3 - Unauthenticated User Data and Con -
CVE-2026-118420
WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via -
CVE-2026-109197
WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection vi -
CVE-2026-96653
WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL -
CVE-2026-16596
WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Inje
Same vendor: Unknown
-
CVE-2026-76792
User Verification 2.0.38 - 2.0.48 - Unauthenticated Account -
CVE-2026-124665
Order Tracking < 3.6.2 - Unauthenticated Customer and Sales -
CVE-2026-124817
Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modi -
CVE-2026-124814
Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticate -
CVE-2026-124815
Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record D