Unauthenticated SQL Injection in WP Directory Kit Plugin

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

WP Directory Kit is a popular WordPress plugin that enables directory listing functionality for WordPress sites. This vulnerability represents a critical SQL injection flaw (CWE-89) where user-supplied input is directly concatenated into SQL queries without proper sanitization or parameterized queries. The severity is compounded by the fact that the vulnerability is exploitable by unauthenticated users—attackers need no credentials to trigger the attack. Any WordPress installation using versions before 1.5.5 of this plugin exposes its database to potential compromise, data exfiltration, and complete site takeover.

Casky's 322 matching skills leverage Claude's extended reasoning to correlate indicators across MITRE ATT&CK Reconnaissance (TA0001) and Resource Development (TA0043) phases alongside exploitation techniques. When scanning for this vulnerability pattern, practitioners would see detection of suspicious SQL syntax in HTTP parameters, unusual database query patterns, and anomalous authentication bypass attempts. Casky's skill mapping identifies the attack chain: reconnaissance activity probing for the vulnerable parameter, crafted payloads designed to break SQL statement structure, and subsequent data exfiltration queries. The platform's ability to reason across 754 security skills means practitioners gain context-aware alerts showing how reconnaissance activities (TA0001) precede exploitation, and can correlate resource development indicators (TA0043) such as payload staging with actual injection attempts, enabling faster incident response and vulnerability prioritization.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18473.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-18473

Casky has 322 skills that investigate the attack patterns behind CVE-2026-18473. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn