CVE-2026-18473 is a SQL injection vulnerability (CWE-89) in the WP Directory Kit WordPress plugin before version 1.5.5. The flaw arises because the plugin does not properly sanitize and escape user-supplied input before incorporating it into SQL statements. This allows unauthenticated attackers to inject malicious SQL code, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated attackers to execute arbitrary SQL queries on the backend database, compromising confidentiality and integrity of data. This can lead to unauthorized data disclosure or modification. Availability impact is not indicated. The vulnerability is critical due to ease of exploitation and high impact on data security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the WP Directory Kit plugin or restricting access to affected functionality to trusted users only.