The vulnerability lies in the WP Directory Kit WordPress plugin, versions prior to 1.5.7, where the "section" parameter is used directly in an SQL query without sanitisation or escaping. Attackers with administrator privileges can inject arbitrary SQL code, potentially retrieving sensitive data from the database. On a multisite WordPress installation this flaw allows a single-site administrator to read data belonging to other sites in the network, which they are normally denied. The attack thus results in a confidentiality breach that can extend beyond the target site, and may also facilitate broader exploitation if the injected payload is expanded to modify data or gain further privileges.

WP Directory Kit plugin versions before 1.5.7 installed on WordPress sites. Multisite WordPress configurations are particularly at risk, as the flaw permits an administrator to access database records from sites they normally cannot reach. Any WordPress installation using this plugin without an updated version is affected.

The vulnerability is classed as SQL Injection (CWE‑89) and applies to systems where administrative access to the plugin is possible. Because the attack vector requires the attacker to act as an administrator, the likelihood of exploitation depends on the number of privileged users and the visibility of the interface. In a publicly accessible multisite network with administrators that can navigate the plugin, the risk is high. No EPSS score is available, and the flaw is not listed in CISA KEV, but the intrinsic severity of an SQL injection that grants cross‑site access warrants immediate attention.