CyberRota Analysis
AI-GeneratedThe WP Directory Kit plugin for WordPress versions up to 1.5.7 is vulnerable to SQL injection due to insufficient sanitization and escaping of widget settings, which can be exploited by authenticated users with Editor-level access or higher. This vulnerability allows attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. WordPress site administrators and developers using this plugin should prioritize patching or mitigating this issue to safeguard against potential exploitation.
Original NVD Description
The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) to perform SQL injection attacks that execute when the affected page is rendered.