The vulnerability is an unauthenticated SQL Injection flaw present in the Directory Pro plugin version 2.5.8 and earlier. Based on the nature of SQL injection, arbitrary SQL commands can be injected via plugin input fields, potentially allowing an attacker to read, modify, or delete data in the WordPress database. This would expose sensitive information, alter data integrity, and possibly disrupt site availability. The weakness is identified as CWE‑89.

Directory Pro plugin, version 2.5.8 and all earlier releases, distributed by e‑plugins. Any WordPress site that has installed these versions is at risk. No specific operating system or PHP version requirements are mentioned, so the impact applies across the plugin’s supported environments.

The CVSS score of 9.3 indicates a high severity, reflecting the critical nature of the flaw once an attacker can execute arbitrary SQL. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but that does not reduce the potential for exploitation. Based on the description, the likely attack vector is through the web interface of the affected plugin, via unauthenticated HTTP requests. An attacker with network access to the site could exploit this vulnerability without requiring authentication, and a local attacker who can manipulate plugin parameters would also be able to do so.