Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

SQL Injection in Web Directory Free <= 1.7.13 versions

CVE-2026-28142 · published 2 months ago
Summary

A security flaw in Web Directory Free allows hackers to access sensitive data without a password. This can happen if you're using a version of Web Directory Free older than 1.7.13. To stay safe, update to the latest version of Web Directory Free.

What to do
  • Update shamalli web directory free to version 2.0.
Affected software
VendorProductAffected versions
shamalli web directory free <= 1.7.13
Fix: upgrade to 2.0
Original advisory text
WordPress Web Directory Free plugin <= 1.7.13 - SQL Injection vulnerability
Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published13 Aug 2026
Updated4 Nov 2026
First seen13 Aug 2026
Sources
CVE-2026-28142 · NVD
CVE-2026-28142 · MITRE
Track software like this
Free during beta