CVE-2026-28001

The WP Directory Kit versions up to 1.5.4 are vulnerable to an unauthenticated SQL injection, allowing attackers to manipulate database queries and potentially gain unauthorized access to sensitive data. This critical vulnerability, rated 9.3 on the CVSS scale, poses a significant risk to any organization using this plugin, particularly those managing user data or sensitive information. Organizations utilizing this plugin should prioritize immediate remediation to mitigate potential data breaches.