The vulnerability resides in the DirectoryPress WordPress plugin where the 'packages' parameter is concatenated directly into an SQL statement without proper escaping or parameterization. An attacker can inject arbitrary SQL into this parameter, causing adjacent queries to execute. Successful exploitation could allow extraction of sensitive data from the site’s database, undermining confidentiality and potentially enabling further compromise.

The affected product is DirectoryPress – Business Directory And Classified Ad Listing from designinvento, with all published releases up to and including version 3.6.26 impacted. No newer version is listed in the data, so any installation of 3.6.26 or earlier must be considered vulnerable unless the vendor has issued a patch beyond this version.

The CVSS score of 7.5 indicates a high severity vulnerability that can be exploited over the web without authentication. EPSS is not available, and the issue is not catalogued in the KEV list, but the lack of required credentials and the potential for data extraction make it a significant risk. An unauthenticated attacker who can reach the affected endpoint can inject SQL statements and retrieve database contents, so the attack vector is likely via a standard HTTP request targeting the plugin’s endpoint.