CVE-2026-109197

{
  "etk_id": "ETK-2026-3175",
  "cve_id": "CVE-2026-109197",
  "display_id": "CVE-2026-109197",
  "ghsa_id": "GHSA-xf7x-7w69-85mx",
  "euvd_id": "EUVD-2026-114703",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated SQL injection in WP Directory Kit",
  "summary": "WP Directory Kit for WordPress through version 1.6.0 is affected by an SQL injection flaw. An unauthenticated remote attacker may manipulate database queries and obtain sensitive database information. Exploitation requires access to the affected plugin functionality.",
  "mitigation": "Update WP Directory Kit to a vendor release later than 1.6.0 after confirming it addresses this issue. Until an update is available, restrict public access to functionality that accepts the affected parameter and limit database account privileges.",
  "vendor": "wpdirectorykit",
  "product": "WP Directory Kit",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.6.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "WP Directory Kit",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.00931295,
  "t0_at": "2026-10-31T09:29:26.446000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-31T13:05:16.744954+00:00",
      "days": 0.149887719375,
      "is_lower_bound": false,
      "measured_at": "2026-10-31T09:29:26.446000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-31T09:29:26.446000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-31T09:29:26.446000+00:00",
      "url": "https://github.com/advisories/GHSA-xf7x-7w69-85mx"
    }
  }
}