The vulnerability allows an attacker to inject arbitrary SQL into database queries by sending a crafted value to the 'field_search' parameter of the WP Directory Kit plugin. This leads to unauthenticated data modification or exfiltration. The plugin does not sanitize or escape the input before using it in a SQL statement. Because the vulnerability exists in all versions prior to 1.5.5, any user can exploit it.

The WP Directory Kit WordPress plugin, available from the WordPress Plugin Directory, is affected in all releases older than 1.5.5. The known vendor identity is Unknown; the product name is WP Directory Kit. Users running the plugin on a WordPress site with these older versions are at risk.

The exploit requires only a web request containing a malicious 'field_search' value, so anyone who can access the search endpoint can trigger the injection. No authentication is necessary. Because the plugin embeds the unsanitized parameter directly into SQL, the attack can potentially read, alter or delete database content. The CVSS score of 9.1 indicates a critical severity, and the EPSS score of < 1% suggests low probability of exploitation at the moment, but the lack of reported exploitation does not diminish the inherent risk of SQL injection. The vulnerability is not listed in CISA KEV.