The flaw is an improper neutralization of special elements in SQL commands, enabling a blind SQL injection through the WordPress WP Directory Kit plugin. This vulnerability allows an attacker to infer database contents, extract sensitive data, and potentially modify or delete database records, leading to a data breach and integrity compromise. The impact can be significant, as attackers can obtain confidential information or manipulate the site’s data base without direct code execution. Based on the description, it is inferred that the attack vector is remote via web input fields provided by the plugin, with no authentication required if the plugin is publicly accessible.

WordPress sites running the WP Directory Kit plugin version 1.5.0 or earlier are affected. The vulnerability applies to all installations using this plugin from its inception through the specified version, regardless of other WordPress configuration details.

The CVSS score of 9.3 categorizes this issue as critical. Although no EPSS score is available, the lack of protection against blind SQL injection suggests that exploitation is feasible with standard techniques. It is not listed in CISA KEV, so no known exploits have been reported, but the high severity and remote attack possibility warrant immediate attention. The most likely attack path involves submitting crafted input data to the plugin’s endpoints to trigger the injection.