WP Directory Kit Plugin SQL Injection via Unauthenticated AJAX

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP Directory Kit WordPress plugin before version 1.5.6 contains a critical SQL injection vulnerability in an authenticated AJAX action that fails to properly sanitize user input before incorporating it into SQL queries. What makes this vulnerability particularly dangerous is the combination of three security failures: missing input sanitization, absent output escaping, and lack of authorization checks on the AJAX endpoint. This means any user with subscriber-level access—the lowest privilege level in WordPress—can craft malicious SQL queries to extract, modify, or delete sensitive database information. Organizations running WordPress sites with this plugin are at risk of data exfiltration, unauthorized access, and potential site compromise, especially in multi-tenant environments where subscriber accounts are commonly provisioned.

Casky's 322 mapped security skills leverage Claude's extended reasoning to detect the attack patterns underlying TA0001 (Initial Access) and TA0043 (Reconnaissance) techniques. When analyzing this vulnerability, practitioners would see Casky identify suspicious patterns including: unauthenticated or low-privilege API calls to AJAX handlers with SQL-like syntax in parameters, attempts to manipulate database queries through input vectors, and reconnaissance activities probing for information disclosure. Claude's reasoning engine correlates CWE-89 (SQL Injection) indicators across multiple detection layers—from parameter analysis and query construction anomalies to privilege escalation attempts from subscriber accounts. Practitioners reviewing their findings would receive detailed context about how attackers could chain this vulnerability with reconnaissance techniques to map database schemas before escalating to data exfiltration, enabling faster incident response and remediation prioritization.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18230.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-18230

Casky has 322 skills that investigate the attack patterns behind CVE-2026-18230. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn