The vulnerability allows an attacker to inject arbitrary SQL into database queries by sending a crafted value to the 'field_search' parameter of the WP Directory Kit plugin. This leads to unauthenticated data modification or exfiltration. The plugin does not sanitize or escape the input before using it in a SQL statement. Because the vulnerability exists in all versions prior to 1.5.5, any user can exploit it.

The WP Directory Kit WordPress plugin, available from the WordPress Plugin Directory, is affected in all releases older than 1.5.5. The known vendor identity is Unknown; the product name is WP Directory Kit. Users running the plugin on a WordPress site with these older versions are at risk.

The exploit requires only a web request containing a malicious 'field_search' value, so anyone who can access the search endpoint can trigger the injection. No authentication is necessary. Because the plugin embeds the unsanitized parameter directly into SQL, the attack can potentially read, alter or delete database content. The EPSS score is not provided, and the vulnerability is not listed in CISA KEV; however, the lack of a reported exploitation rate does not diminish the inherent risk of SQL injection. There is no published CVSS score, so the exact severity cannot be quantified from the available data.