nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-13138 CVE-2025-13138
HIGHNuclei
WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function
Record summary
CVE-2025-13138 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.
Description
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 21, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
WP Directory KitBrowse wpdirectorykit / WP Directory KitDefault status: unaffected | CVE List | Through 1.4.3 | affected |
Nuclei templates
1ProjectDiscoveryHIGHWP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection
The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Impact
An unauthenticated attacker can extract sensitive information from the WordPress database including user credentials, posts, and other data.
Remediation
Update WP Directory Kit plugin to version 1.4.4 or later.
AuthorsShivam Kamboj
Template tagscvecve2025wordpresswp-pluginsqliwpdirectorykitunauthwptime-based
Shodan: html:"plugins/wpdirectorykit/"
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpdirectorykit/wp-directory-kit-143-unauthenticated-sql-injection-via-select-2-ajax-function https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.4.3/application/controllers/Wdk_frontendajax.php#L546
Source: ProjectDiscovery
References
5plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.4.3/application/controllers/Wdk_frontendajax.php plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3396348%40wpdirectorykit&new=3396348%40wpdirectorykit&sfp_email=&sfph_mail= wordpress.org
https://wordpress.org/plugins/wpdirectorykit wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/0cad8c48-5c96-484c-acda-b33d8d8d10d3?source=cve