Improper neutralization of special elements used in an SQL command in WP Directory Kit allows blind SQL injection. This can enable an attacker to read, modify, or delete database contents, potentially exposing sensitive user data or corrupting site data. The weakness is classified as CWE-89.

WordPress sites that use WP Directory Kit plugin version 1.5.1 or earlier are affected. All installations of the plugin from its earliest release through 1.5.1 are vulnerable.

The CVSS score of 9.3 identifies it as critical. EPSS information is unavailable, making precise exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the web interface, where a remote attacker can submit crafted requests to the plugin’s endpoints to perform blind SQL injection when the plugin processes unsanitized input.