WordPress WP Directory Kit Plugin SQL Injection Vulnerability (CVE-2026-109197) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTAll versions of WP Directory Kit plugin for WordPress up to, and including, 1.6.0
Unauthenticated remote attackers can inject malicious SQL queries to extract sensitive database information
Immediately upgrade the WP Directory Kit plugin to the latest secure version (1.6.1 or higher)
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The primary remediation is to upgrade the WP Directory Kit plugin to the latest secure version using WP-CLI.
# Update the WP Directory Kit plugin using WP-CLI
wp plugin update wpdirectorykit --activate
# Verify the currently installed version
wp plugin get wpdirectorykit --field=version2. Temporary Workaround & Hardening Configuration
If an immediate update is not feasible, deploy Web Application Firewall (WAF) rules to block suspicious payloads targeting the 'idfield' parameter. Below is an example of an Nginx configuration to mitigate basic SQL injection attempts.
# Block malicious requests containing SQL keywords in the idfield parameter
if ($query_string ~* 'idfield=.*(select|union|insert|update|delete|drop|and|or|char|concat)') {
return 403;
}3. Log Audit & IoC Verification Commands
Analyze your web server access logs to identify potential exploitation attempts targeting the vulnerable parameter.
# Scan web server access logs for SQL injection patterns in the idfield parameter
grep -Ei 'idfield=.*(select|union|concat|char|information_schema)' /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/nullBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-109197) exists in the WP Directory Kit plugin for WordPress due to insufficient escaping on the user-supplied 'idfield' parameter and a lack of proper preparation on the existing SQL query. This allows input values to break out of the intended SQL context, leading to a classic SQL Injection (CWE-89) vulnerability.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker can craft malicious HTTP requests containing SQL payloads within the 'idfield' parameter. Because the application fails to sanitize or parameterize this input before executing the query, the database engine executes the appended SQL commands. Attackers can leverage techniques such as UNION-based or error-based SQL injection to extract sensitive data, including WordPress user credentials and configuration details.
3. Infrastructure & Business Impact
With a CVSS score of 7.5 (High), this vulnerability poses a significant threat to data confidentiality. Successful exploitation allows unauthorized access to the entire WordPress database. If administrator password hashes are retrieved and cracked, it could lead to complete site takeover, data breaches, and severe compliance violations.
Official Vendor Advisories & References
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Frequently Asked SecOps Questions (CVE-2026-109197)
FAQQ1. How critical is CVE-2026-109197 and is it actively exploited in the wild?
CVE-2026-109197 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 0.4%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-109197?
Primary impacted vendors include wpdirectorykit across wp-directory-kit. Scope summary: All versions of WP Directory Kit plugin up to and including 1.6.0
Q3. What temporary mitigations or workarounds exist for CVE-2026-109197 before patching?
[Mitigation] Immediately upgrade the WP Directory Kit plugin to the latest secure version (1.6.1 or higher) Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-109197
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (wpdirectorykit)
View Category →LiteLLM Proxy Server SQL Injection Vulnerability (CVE-2026-42208) Security Advisory
[Affected Scope] LiteLLM proxy server environments running versions from 1.81.16 to before 1.83.7
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Drupal Core SQL Injection Vulnerability (CVE-2026-9082) Critical Security Advisory
[Affected Scope] Drupal core versions 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, and 11.3.0 to < 11.3.10
WordPress WP_Query 'author__not_in' Parameter SQL Injection Vulnerability (CVE-2026-60137)
[Affected Scope] WordPress core versions 6.8.x (before 6.8.6), 6.9.x (before 6.9.5), and 7.0.x (before 7.0.2)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.