The WP Directory Kit plugin for WordPress contains a flaw in the select_2_ajax() function: the columns_search parameter is not escaped and the overall query is not properly prepared. This allows an attacker to inject arbitrary SQL commands. Consequently, an unauthenticated visitor can append additional queries to the existing database statements and retrieve sensitive information, exposing confidential data. The weakness aligns with CWE‑89, reflecting an improper neutralization of input used in an SQL context.

Any WordPress installation that has the WP Directory Kit plugin installed in versions 1.4.3 or earlier is vulnerable. The plugin vendor is wpdirectorykit, and the issue affects all normal users of the plugin on any site running those versions.

The CVSS score of 7.5 indicates a high severity vulnerability that can be exploited remotely without credentials. An EPSS score of 10% suggests moderate probability of exploitation in the near term. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can launch the exploit by sending a crafted HTTP request to the plugin’s AJAX endpoint, leveraging the unauthenticated nature of the call. If successful, they could exfiltrate user data, login credentials, or other database contents.