CVE-2026-28142— WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Shamalli | Web Directory Free | n/a≤ 1.7.13 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-28142
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Web Directory Free SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Web Directory Free是WordPress基金会开源的一款网站目录管理插件，提供目录展示与分类功能。 WordPress Web Directory Free 1.7.13及之前版本存在SQL注入漏洞，该漏洞源于未经验证的输入，可能导致SQL注入攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Shamalli | Web Directory Free | n/a ~ 1.7.13 | - |
II. Public POCs for CVE-2026-28142
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-28142
请登录查看更多情报信息。
News Coverage for CVE-2026-28142 (1)
IV. Related Vulnerabilities
Same product: Web Directory Free
- CVE-2026-14785
Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection - CVE-2025-69018
WordPress Web Directory Free plugin <= 1.7.12 - Cross Site S - CVE-2025-39567
WordPress Web Directory Free plugin <= 1.7.8 - Reflected Cro - CVE-2025-30908
WordPress Web Directory Free plugin <= 1.7.6 - CSRF to Cross - CVE-2025-28904
WordPress Web Directory Free plugin <= 1.7.6 - SQL Injection
Same vendor: Shamalli
- CVE-2025-69018
WordPress Web Directory Free plugin <= 1.7.12 - Cross Site S - CVE-2025-39567
WordPress Web Directory Free plugin <= 1.7.8 - Reflected Cro - CVE-2025-30908
WordPress Web Directory Free plugin <= 1.7.6 - CSRF to Cross - CVE-2025-28904
WordPress Web Directory Free plugin <= 1.7.6 - SQL Injection - CVE-2024-47379
WordPress Web Directory Free plugin <= 1.7.3 - Reflected Cro
Same weakness: CWE-89
- CVE-2026-74015
WordPress Readabler plugin < 2.0.18 - SQL Injection vulnerab - CVE-2026-73392
WordPress Super Store Finder plugin <= 7.8 - SQL Injection v - CVE-2026-73365
WordPress JetAppointment plugin <= 2.5.2 - SQL Injection vul - CVE-2026-73355
WordPress Affiliates Manager plugin <= 2.9.53 - SQL Injectio - CVE-2026-73345
WordPress License Manager for WooCommerce plugin <= 3.0.18 -
V. Comments for CVE-2026-28142
No comments yet