CVE-2026-16593 identifies a SQL injection vulnerability in the WP Directory Kit WordPress plugin through version 1.5.7. The vulnerability arises from improper sanitization and escaping of certain widget settings before their inclusion in SQL statements. This allows authenticated users with Editor or higher roles, who can access the page builder, to inject malicious SQL code that executes during page rendering. No CVSS score or vendor advisory is provided, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated user with Editor or higher privileges to execute arbitrary SQL commands on the database via crafted widget settings. This could lead to unauthorized data access, modification, or other database impacts depending on the privileges of the database user. However, exploitation requires authenticated access with elevated permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Editor and higher user access to trusted individuals only and monitor for suspicious activity related to widget settings. Avoid granting page builder access to untrusted users.