CVE-2026-39531: WP Directory Kit Blind SQL Injection Flaw Rated Critical

The National Vulnerability Database has identified a critical SQL injection vulnerability, CVE-2026-39531, in the WP Directory Kit plugin. This flaw allows for blind SQL injection attacks, meaning an attacker can infer data from the database without directly seeing the output. The vulnerability affects versions up to and including 1.5.0.

With a CVSS score of 9.3, this is a severe security issue. Attackers can exploit this vulnerability remotely without needing any prior authentication or user interaction. The ‘S:C’ (Scope: Changed) component in the CVSS vector indicates that the vulnerability could impact components beyond the vulnerable application itself, potentially leading to broader system compromise.

Defenders should prioritize patching or removing WP Directory Kit versions prior to 1.5.0 immediately. Given the critical nature and ease of exploitation, organizations must assume this vulnerability is actively being targeted. A thorough audit of web application firewall (WAF) logs for suspicious SQL query patterns is also advised.