The vulnerability lies in the WP Directory Kit WordPress plugin versions prior to 1.5.7, where the "section" parameter is used directly in an SQL query without sanitisation or escaping. Attackers with administrator privileges can inject arbitrary SQL code, potentially retrieving sensitive data from the database. On a multisite WordPress installation this flaw allows a single‑site administrator to read data belonging to other sites in the network, which they are normally denied. The attack thus results in a confidentiality breach that can extend beyond the target site, and may also facilitate broader exploitation if the injected payload is expanded to modify data or gain further privileges.

WP Directory Kit plugin versions before 1.5.7 installed on WordPress sites. Multisite WordPress configurations are particularly at risk, as the flaw permits an administrator of a single site to access database records from sites they normally cannot reach. Any WordPress installation using this plugin without an updated version is affected.

The vulnerability is classed as SQL Injection (CWE-89) and applies to systems where administrative access to the plugin is possible. The CVSS score of 7.2 reflects a high severity exposure. The EPSS score of less than 1% suggests a low probability of exploitation in the wider threat landscape, but the impact remains high if an attacker gains administrator privileges. On a publicly accessible multisite network with administrators that can navigate the plugin, the risk is high. The flaw is not listed in CISA KEV, but the intrinsic severity of an SQL injection that grants cross‑site access warrants immediate attention.