CVE-2026-28142
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Unauthenticated SQL Injection vulnerability in Web Directory Free versions up to 1.7.13. An attacker can execute arbitrary SQL queries without authentication.
Risk Assessment
Risk includes unauthorized access to the database, potentially leading to data leakage, modification, or deletion.
Recommendation
Update the plugin to the latest patched version. Restrict access to the admin panel and monitor logs for suspicious queries.
Other vulnerabilities in Web Directory Free
See all- CVE-2026-14785High
The Web Directory Free plugin for WordPress up to version 1.7.13 is vulnerable to generic SQL Injection via the 'levels' parameter. Insufficient input sanitization and lack of prepared statements allow unauthenticated attackers to append additional SQL queries, potentially leading to extraction of sensitive database information.
- CVE-2025-69018Medium
A DOM-Based Cross-site Scripting vulnerability in the Web Directory Free plugin (versions up to and including 1.7.12) arises from improper neutralization of input during web page generation. An attacker can inject a malicious script that executes in the user's browser.
Original NVD description (English source)
Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS