What is CVE-2026-18653?
The WP Directory Kit WordPress plugin before version 1.5.7 does not sanitize and escape a parameter used in a SQL statement, allowing administrators to perform SQL injection attacks. On multisite installations, this vulnerability enables an administrator of a single site to read data belonging to the entire network. Updating to version 1.5.7 or later is recommended.
Azərbaycanca: WP Directory Kit WordPress plaqini 1.5.7 versiyasından əvvəlki versiyalarda SQL sorğusunda istifadə olunan parametri düzgün sanitizə etmir, bu da administratorlara SQL injection hücumu etməyə imkan verir. Multisite qurğularında bu zəiflik bir saytın administratoruna bütün şəbəkəyə aid məlumatları oxumağa şərait yaradır. Plaqini ən azı 1.5.7 versiyasına yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-89
FAQ1
What risk does the CVE-2026-18653 vulnerability in the WP Directory Kit plugin pose on multisite installations?
On multisite installations, this vulnerability enables an administrator of a single site to read data belonging to the entire network.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.