WP Directory Kit EUVD-2026-54738

Requires a valid WordPress user account at any role level, including Subscriber - the lowest tier typically available via open user registration. The vulnerable AJAX endpoint explicitly lacks both WordPress capability checks and nonce validation, meaning the standard role-based access controls are entirely bypassed. Target site must have WP Directory Kit installed and activated in a version before 1.5.5. Exploitation is limited to: (1) sites with this specific plugin active, and (2) where the attacker can obtain any authenticated session (via registration, credential theft, or other means). Sites with user registration disabled are exposed only if credentials are available through another attack path. Impact is limited to confidentiality (C:H) - the described injection path does not support write operations (I:N, A:N) based on the CVSS vector.

The CVSS base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) is well-calibrated: low attack complexity, no user interaction, and only a Subscriber account required make this straightforward to exploit over the network. The scope change to C:H signals that the full WordPress database - including wp_users with hashed administrator credentials - is within reach. The missing I and A impact reflects a read-only injection path as described. EPSS at 0.16% (6th percentile) is notably low for a publicly disclosed SQL injection with available POC, suggesting exploitation has not yet become automated or widespread - this may change rapidly given the POC. No KEV listing confirms no confirmed mass exploitation at time of analysis. The effective attack surface is gated by whether user registration is open on the target site; sites with closed registration are exposed only if an attacker can obtain any valid credential through other means. This is a genuine priority for multi-user WordPress deployments with open registration.

An attacker registers a free account on a WordPress site running WP Directory Kit before 1.5.5, obtaining Subscriber-level credentials. They then POST a crafted request to wp-admin/admin-ajax.php targeting the vulnerable action, embedding a SQL injection payload in the unsanitized parameter - since neither authorization nor nonce is checked, the request is processed directly. Using a tool like sqlmap against the public POC endpoint, the attacker dumps the wp_users table within minutes, recovering administrator email addresses and password hashes for offline cracking or credential stuffing.