PT-2025-51043 · WordPress · Wp Directory Kit

Tmrswrr · Published 2025-12-13 · Updated 2025-12-18 · CVE-2025-13089

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.4.8

Description The WP Directory Kit plugin for WordPress is susceptible to SQL Injection through the hide fields and attr search parameter. Insufficient input sanitization and inadequate SQL query preparation allow unauthenticated attackers to inject additional SQL queries, potentially extracting sensitive information from the database.

Recommendations Update WP Directory Kit to version 1.4.8 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-13089

Affected Products

Wp Directory Kit

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13089 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b0696cbe-70e0-402d-bcfd-40907a973785?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3412635%40wpdirectorykit&new=3412635%40wpdirectorykit&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3396348%40wpdirectorykit&new=3396348%40wpdirectorykit&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1999865380966400380 · Twitter Post
• https://twitter.com/RedPacketSec/status/1999948254033654140 · Twitter Post
• https://t.me/CVEtracker/39684 · Telegram Post
• https://twitter.com/cracbot/status/2001608426405978569 · Twitter Post