WP Directory Kit CVE-2026-28001

Exploitation requires only that a reachable WordPress site have the WP Directory Kit plugin (version <= 1.5.4) installed and active, exposing the vulnerable directory query parameter to unauthenticated HTTP requests - no valid account, no user interaction, and no non-default configuration are indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is deployment scope: only sites that have installed and activated this specific plugin are exposed, and exploitation is constrained to whatever data and operations the plugin's database queries can reach. The exact vulnerable endpoint/parameter is not enumerated in the provided data and should be confirmed against the Patchstack advisory.

The signals are consistent for an internet-facing, easily exploitable web flaw: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N indicates a network-reachable, low-complexity attack requiring no authentication or user interaction, and CWE-89 SQLi is a well-understood, frequently automated class. This pushes it toward high real-world priority for any exposed installation. Tempering that: it is NOT in CISA KEV (no confirmed active exploitation), no POC is referenced, and no EPSS score was supplied, so exploitation probability cannot be quantified from the input. Note also an internal inconsistency to verify: the CVSS lists C:H but I:N/A:L, which understates the write/manipulation potential typical of SQLi - SQL injection often permits data modification (I) and, via UNION/blind extraction, more impact than a low availability rating suggests. Overall this is a genuine priority for exposed WordPress sites running the plugin, though the absence of KEV/POC/EPSS means impact is inferred from vector and CWE rather than confirmed exploitation telemetry.

An attacker locates a WordPress site running WP Directory Kit 1.5.4 or earlier and, without any account or login, sends crafted HTTP requests to a vulnerable directory search or filter parameter with injected SQL payloads. Using boolean/blind or UNION-based techniques, they extract WordPress user records, password hashes, and secret keys from the shared database. No public POC is referenced in the available data, but the low-complexity, no-authentication vector makes automated mass scanning plausible once details circulate.