The vulnerability resides in the WP Directory Kit WordPress plugin prior to version 1.5.5. It occurs because the plugin fails to sanitize and escape the data_fields_list parameter before including it in a SQL query within an AJAX action. The action lacks both authentication and nonce verification, allowing any authenticated user, including a basic Subscriber, to inject arbitrary SQL code. An attacker could use this flaw to read, modify, or delete data from the database, potentially exfiltrating sensitive information or compromising the integrity of the site.

Affected are installations of WP Directory Kit with versions older than 1.5.5. The plugin is distributed through the WordPress plugin repository and is installed on WordPress sites that require directory or listing functionality. No specific vendor version map is listed beyond the version threshold.

The risk is high because no authentication checks are performed beyond a logged‑in state, and the SQL injection can be performed through a browser or programmatically via the exposed AJAX endpoint. The EPSS score is <1%, and the vulnerability is not currently referenced in the CISA KEV catalog. The CVSS score is 7.7. The vector is through authenticated access, so an attacker must first gain legitimate credentials, such as a Subscriber account, but once authenticated can exploit the plugin anywhere on the site.