CVE-2026-96653Published
WP Directory Kit <= 1.5.9 - Authenticated (Subscriber+) SQL Injection via 'display_name' Profile Field (Second-Order)
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-96653 · Microsoft / collected KEV context
cve-program · CVE-2026-96653
- https://www.wordfence.com/threat-intel/vulnerabilities/id/87aa7d7e-f6f4-42c1-9b15-2fcab6750cd3?source=cve
- https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/vendor/Winter_MVC/core/database.php#L553
- https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/extensions/wdk-cached-user-editor.php#L52
- https://plugins.trac.wordpress.org/browser/wpdirectorykit/trunk/extensions/wdk-cached-user-editor.php#L21
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.