The Web Directory Free plugin for WordPress contains a classic SQL injection flaw tied to the 'levels' request parameter. Because the input is not properly escaped or bound, an attacker can inject additional SQL statements into the query. This vulnerability is classified as CWE‑89 and allows a threat actor to read private data from the database without needing to authenticate to the site or have any special privileges.

All WordPress installations running the Web Directory Free plugin version 1.7.13 or earlier are affected. The issue exists in all main plugin files, including ajax_controller.php and frontend_controller.php, and impacts any site that has the plugin active.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely on a large scale, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, an unauthenticated attacker can trigger the flaw by sending a crafted HTTP request containing a malicious 'levels' value, which the plugin appends directly into a SQL statement. Successful exploitation would allow data extraction from the WordPress database, potentially compromising user accounts, content, and other sensitive information.