Web 2.0 Directory CVE-2026-15272

Exploitation targets the directory-listing filter feature via the specific 'w2dc_level_filter' request parameter, which is placed into a SQL query in integer context without surrounding quotes; this specific placement is why WordPress's built-in addslashes/magic_quotes escaping provides no protection against SLEEP-based time-based payloads. It affects all versions up to and including 2.10.12 and no non-default configuration is described as required. The principal limiting factors are: (1) the privilege level is unresolved - the description says unauthenticated but the CVSS vector encodes PR:L, so authentication may in fact be required; and (2) the blind/time-based technique yields data slowly through timing inference rather than direct output, making bulk extraction slow and detectable.

This is a moderate-priority issue with a notable internal data conflict that must be resolved before final triage. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) encodes PR:L, implying an authenticated attacker, yet the description explicitly states 'unauthenticated attackers' can exploit it - these two signals disagree, and the true privilege requirement should be verified with Wordfence/the vendor before prioritization. If the description is correct (unauthenticated), real-world risk is meaningfully higher than the 6.5 score suggests and an independent recompute lands near 7.5. The flaw is a time-based (blind) SQL injection via an integer-context parameter, which the description confirms defeats WordPress's addslashes/magic_quotes escaping - a credible, well-understood exploitation primitive. Countervailing factors: no EPSS score was provided, the CVE is NOT in CISA KEV, no public exploit or PoC code is indicated in the references (only a Wordfence threat-intel page and the CodeCanyon product listing), and the blind/time-based nature makes extraction slow and noisy rather than instantaneous. The vuln.today decision label is 'this_month' - meaningful but not emergency/act_now. Net: a legitimate issue warranting patching on a normal cycle, elevated if the unauthenticated claim holds, but not currently evidenced as under active or automated exploitation.

An attacker sends a crafted request to the directory-listing filter functionality with a malicious 'w2dc_level_filter' value containing a SLEEP-based conditional; by observing response delays the attacker infers database contents one boolean at a time and gradually extracts sensitive data such as user records or credentials hashes. The description indicates no authentication is needed, though the supplied CVSS vector's PR:L contradicts this. No public exploit code is identified in the provided references.