WP Directory Kit CVE-2026-27538

The target WordPress site must have WP Directory Kit version 1.5.4 or earlier installed and active; deactivated or uninstalled instances are not exposed. The CVSS vector (PR:N, UI:N) confirms that no authentication and no victim interaction are required. The AC:H rating indicates a specific plugin endpoint or request parameter condition must be met to reach the injectable code path - likely a directory search, filter, or listing query parameter - meaning opportunistic scanners may need to understand the plugin's request structure to reliably trigger the flaw. No special server-side configuration beyond standard WordPress on PHP and MySQL/MariaDB is required. Exploitation is limited to sites with the plugin actively installed; network reachability to the WordPress front-end HTTP/HTTPS port is the only infrastructure prerequisite.

The CVSS 7.5 score combines a network-accessible, unauthenticated (PR:N, UI:N) attack vector with high confidentiality impact and scope change - a combination that typically demands urgent prioritization. The AC:H rating introduces a practical exploitation barrier, as some specific parameter condition or request path must be met, but this should not be treated as a reliable compensating control given that skilled attackers routinely bypass such conditions through fuzzing and plugin source review. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified statistically. No CISA KEV listing and no proof-of-concept code have been identified, which moderates immediate threat urgency compared to actively weaponized CVEs - even a mid-sized municipal IT team in legnica managing a community-facing directory portal should treat this as urgent given the zero-authentication requirement and the potential for harvesting all site credentials from the shared database. The I:N metric (no integrity impact) is notable for a SQL injection: it likely reflects read-only exploitation behavior, but defenders should not assume write operations are impossible without further vendor confirmation.

An unauthenticated remote attacker identifies an internet-facing WordPress site running WP Directory Kit 1.5.4 or earlier - readily discoverable via passive enumeration of plugin file paths. The attacker sends a crafted HTTP request to the vulnerable plugin endpoint with SQL metacharacters embedded in a directory search or filter parameter, which the plugin passes to the database without sanitization. The injected query extracts the wp_users table, yielding hashed passwords for all WordPress accounts, along with wp_options contents that may include API keys, SMTP credentials, or secret keys used for session signing.