The Web 2.0 Directory plugin for WordPress contains a time‑based SQL injection flaw. An attacker can send specially crafted requests to the w2dc_level_filter parameter. Because the parameter is placed in an integer context without quoting, escaping functions do not neutralise SQL payloads, enabling the attacker to inject additional SQL statements that can be used to read data from the database. The weakness is a classic SQL injection (CWE‑89).

WordPress sites using the Shamalli Web 2.0 Directory plugin up to and including version 2.10.12 are affected. The vulnerability is present in all releases of the plugin with a w2dc_level_filter parameter.

The flaw receives a CVSS score of 6.5, indicating moderate risk. No EPSS data is available and the vulnerability is not listed in CISA's KEV catalog. Because the injection can be performed unauthenticated over the web, an attacker can target any WordPress site that has the vulnerable plugin without needing special credentials. A time‑based payload, such as a SLEEP function, can verify the presence of the flaw and subsequently be extended to extract table contents. The absence of mitigation measures in the plugin means the vulnerability is readily exploitable.