CVE-2026-16589 is a SQL injection vulnerability in the WP Directory Kit WordPress plugin versions prior to 1.5.5. The vulnerability occurs because an authenticated AJAX action fails to properly sanitize and escape user-supplied input before incorporating it into a SQL query. Additionally, the AJAX action lacks authorization and nonce verification, enabling any authenticated user, including Subscribers, to exploit this flaw to perform SQL injection attacks. This could lead to unauthorized access to or manipulation of the database.

Successful exploitation allows an authenticated user with low privileges to execute SQL injection attacks, potentially leading to unauthorized access to sensitive data in the database. The CVSS score of 7.7 (High) reflects the network attack vector, low attack complexity, and the fact that only privileges of an authenticated user are required. The impact is limited to confidentiality compromise; integrity and availability impacts are not indicated.

No official patch or remediation level is currently confirmed. Users should upgrade to WP Directory Kit version 1.5.5 or later once available, as the vulnerability affects versions prior to 1.5.5. Until a fix is released, restrict authenticated user roles and monitor for suspicious activity related to AJAX actions. Check the vendor advisory for updates on patch availability.