The WP Directory Kit plugin for WordPress contains a classic SQL injection vulnerability arising from inadequate escaping of the 'search' parameter and the absence of prepared statements. This flaw permits an attacker who can authenticate as an Administrator or higher to append arbitrary SQL commands to the existing query. The result is that sensitive database content—such as user credentials, site content, or configuration data—can be exposed. The vulnerability does not grant code execution, but it directly compromises confidentiality by allowing read‑only data extraction.

All installations of WP Directory Kit version 1.4.6 or earlier that are running on WordPress. Only users who legitimately hold Administrator or higher privileges within the WordPress instance can exploit the flaw, as authentication is required to access the vulnerable endpoint.

The CVSS score of 4.9 indicates moderate severity. The EPSS score of less than 1% suggests that real‑world exploitation is unlikely at present, and the flaw is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is a targeted web request sent to the plugin’s interface containing a crafted 'search' parameter. The attack would need an authenticated session; there are no known public exploits, but the injection path is straightforward for an attacker with the requisite credentials.