CVE-2026-16596 describes a SQL Injection vulnerability in the WP Directory Kit WordPress plugin affecting all versions up to and including 1.5.4. The issue is due to improper neutralization of special elements in the 'data_fields_list' parameter, allowing authenticated attackers with custom-level privileges or above to inject additional SQL commands into existing queries. This can lead to unauthorized extraction of sensitive data from the database. The CVSS 3.1 base score is 6.5, indicating a medium severity vulnerability with network attack vector, low attack complexity, and requiring privileges but no user interaction.

Exploitation allows authenticated users with custom-level access or higher to perform SQL Injection attacks, potentially extracting sensitive information from the database. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict custom-level user access where possible and consider disabling or removing the WP Directory Kit plugin if not essential. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.