CVE-2026-18230 is a SQL injection vulnerability in the WP Directory Kit WordPress plugin prior to version 1.5.6. The vulnerability arises from improper sanitization and escaping of a parameter used in a SQL query within an authenticated AJAX action. This action does not enforce authorization checks, allowing any authenticated user, including Subscribers, to inject malicious SQL code. No CVSS score or patch information is currently available, and no known exploits are reported in the wild.

An attacker with any authenticated user privileges can exploit this vulnerability to perform SQL injection attacks. This could lead to unauthorized data access, data modification, or other impacts typical of SQL injection vulnerabilities depending on the database and application context. However, the exact impact depends on the database permissions and the queries executed by the vulnerable AJAX action.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user roles that can access the vulnerable AJAX action or apply custom code to sanitize inputs and enforce authorization checks on the affected endpoint.