The WP Directory Kit plugin is vulnerable to SQL injection through the 'hide_fields' and 'attr_search' parameters, allowing an unauthenticated attacker to append malicious SQL to existing queries and retrieve sensitive database information. This vulnerability is a classic CWE‑89 input validation flaw that can compromise confidentiality of WordPress site data.

WordPress sites running WP Directory Kit version 1.4.7 or earlier are affected. The plugin must be updated to a version that removes the vulnerable parameters or is removed entirely.

The CVSS score of 7.5 indicates a high severity risk, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently listed in CISA KEV. Attackers can exploit the flaw by sending crafted HTTP requests to the plugin’s endpoints with the vulnerable parameters, with no authentication required, to inject arbitrary SQL.