Improper neutralization of special elements used in an SQL command in the Dynamic User Directory plugin allows a blind SQL injection attack. An attacker can send crafted input to the plugin’s endpoints, causing the server to execute arbitrary SQL queries against the backend database. This may lead to exposure of sensitive data and alteration of database contents, but the CVE description does not claim privilege escalation or remote code execution.

The vulnerability exists in Sarah Giles’ Dynamic User Directory plugin versions 2.4 and earlier. WordPress sites that have installed this plugin and allow public or authenticated users to interact with its interface are affected.

The CVSS score of 7.6 indicates a high severity with common web-based attack vectors. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The likely attack path requires sending malicious requests to the plugin endpoint that processes user-supplied data; a blind injection limits immediate impact but still allows data extraction if the adversary can infer results from response timing or other side channels.