CyberRota Analysis
AI-GeneratedThe WP Directory Kit plugin for WordPress versions prior to 1.5.6 is vulnerable to SQL injection due to insufficient sanitization and escaping of parameters in an authenticated AJAX action that lacks proper authorization checks. This flaw allows any authenticated user, including those with minimal privileges like Subscribers, to execute arbitrary SQL queries, potentially compromising the database. WordPress site administrators and security teams should prioritize patching this vulnerability to protect against unauthorized data manipulation and access.
Original NVD Description
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.