PT-2025-47716 · WordPress · Wp Directory Kit

Tmrswrr · Published 2025-11-21 · Updated 2026-02-05 · CVE-2025-13138

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.4.4

Description The WP Directory Kit plugin for WordPress is susceptible to SQL Injection through the columns search parameter of the select 2 ajax() function. Insufficient input sanitization and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database.

Recommendations Update WP Directory Kit to version 1.4.4 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-13138

Affected Products

Wp Directory Kit

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-13138 · Security Note
• https://t.me/cveNotify/143545 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.4.3/application/controllers/Wdk_frontendajax.php#L546 · Note
• https://twitter.com/CVEnew/status/1991813180838871047 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3396348%40wpdirectorykit&new=3396348%40wpdirectorykit&sfp_email=&sfph_mail= · Note
• https://twitter.com/pdnuclei_bot/status/2019410715384377666 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0cad8c48-5c96-484c-acda-b33d8d8d10d3?source=cve · Note
• https://wordpress.org/plugins/wpdirectorykit · Note
• https://t.me/CVEtracker/37928 · Telegram Post
• https://twitter.com/cracbot/status/1993635904502759657 · Twitter Post