WP Directory Kit EUVD-2026-57101

Two specific conditions must both be satisfied for exploitation: (1) WP Directory Kit plugin version prior to 1.5.6 must be installed and active on a WordPress site, and (2) a non-default search field type must be explicitly configured in the plugin's admin settings - sites running the default search field configuration are NOT vulnerable. The CVSS PR:N confirms no authentication is required, and UI:N confirms no victim interaction is needed; once a vulnerable configuration is identified, exploitation is fully remote and automated. The key factor limiting the exploitable population is that the non-default configuration must have been deliberately set by an administrator - passive attackers cannot trigger this without first identifying such sites. No specific platform, hosting environment, or WordPress version constraint is documented beyond the plugin version requirement.

The NVD CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects high-severity unauthenticated remote exploitation with confidentiality impact across database scope. However, the AC:L designation warrants scrutiny: the description explicitly requires a non-default search field type to be configured, which is a real-world constraint that narrows the exploitable population - even a mid-sized municipal IT team in rybnik should treat this as urgent if they have customized WP Directory Kit's search field settings away from defaults. A publicly available proof-of-concept exploit (reported via WPScan) confirms the attack is demonstrable with low skill threshold. EPSS data is absent from the available dataset, which limits probabilistic exploitation forecasting. SSVC signals are unfavorable: the attack is automatable (AV:N, no UI), requires no privileges, and delivers high technical impact (full database read). The primary limiting factor - non-default configuration - means mass-scanning attacks will yield a smaller victim pool than a pure AC:L score implies, but WordPress plugin misconfiguration is routinely exploited at scale. No CISA KEV listing is present, so active exploitation in the wild is not confirmed. Overall: high priority for any site with the non-default search configuration; moderate urgency for the broader WordPress ecosystem.

An attacker scans the internet for WordPress installations exposing WP Directory Kit plugin assets, then probes directory search endpoints to identify sites with the non-default search field type active - detectable via distinct HTML form elements or parameter names. Using the publicly available WPScan proof-of-concept, the attacker submits a crafted unauthenticated HTTP request containing a SQL injection payload in the vulnerable search parameter. The database returns sensitive content including WordPress user password hashes, email addresses, and any other data stored in the site's MySQL database, enabling offline credential cracking and account takeover.