The WP Directory Kit plugin for WordPress contains a flaw in the select_2_ajax() function: the columns_search parameter is not escaped and the overall query is not properly prepared. This allows an attacker to inject arbitrary SQL commands. Consequently, an unauthenticated visitor can append additional queries to the existing database statements and retrieve sensitive information, exposing confidential data. The weakness aligns with CWE‑89, reflecting an improper neutralization of input used in an SQL context.

Any WordPress installation running the WP Directory Kit plugin, version 1.4.3 or earlier, is vulnerable. The issue impacts all normal users of the plugin on any site that uses those versions.

The CVSS score of 7.5 indicates a high severity vulnerability that can be exploited remotely without credentials. An EPSS score of 1% suggests a very low probability of exploitation in the near term. The vulnerability is not yet listed in the CISA KEV catalog. Attackers can launch the exploit by sending a crafted HTTP request to the plugin’s AJAX endpoint, leveraging the unauthenticated nature of the call. If successful, they could exfiltrate user data, login credentials, or other database contents.