SQL Injection in WP Directory Kit WordPress Plugin

Executive Summary

This is a SQL injection vulnerability in the WP Directory Kit WordPress plugin before version 1.5.5. It occurs because the plugin does not properly sanitize and escape a parameter called data_fields_list before using it in a SQL query. The vulnerability is accessible through an authenticated AJAX action that lacks authorization and nonce checks, allowing any logged-in user, even with low privileges like Subscriber, to exploit it.

Useful 0 Not Useful 0

Detection Guidance

Check if the WP Directory Kit plugin is installed and verify its version. If it is below 1.5.5, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to manipulate your WordPress database, potentially stealing sensitive data like user credentials, personal information, or content. They might also delete or alter database entries, leading to website disruption or defacement. Since any authenticated user can exploit it, the risk is higher if your site allows public registrations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal data, violating GDPR and HIPAA requirements for data protection and security. Organizations may face fines or penalties if they fail to address it promptly, as it undermines data integrity and confidentiality controls.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP Directory Kit plugin to version 1.5.5 or later immediately. Remove or disable the plugin if updating is not possible. Ensure all WordPress users have minimal necessary privileges.

Useful 0 Not Useful 0