WP Directory Kit EUVD-2026-89671

Exploitation requires an authenticated WordPress account with the plugin's 'custom-level access' role or higher (PR:L), reachable over the network with no user interaction, against WP Directory Kit versions up to and including 1.5.4. The specific injection point is the 'data_fields_list' parameter, which is insufficiently escaped and passed into an unprepared SQL query. The primary limiting factor is the authentication/privilege prerequisite - an attacker must first acquire custom-level access - which prevents fully unauthenticated mass exploitation; impact is confined to database read/confidentiality with no integrity or availability effect.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) describes a network-exploitable, low-complexity SQL injection requiring authentication at 'custom-level access and above' (PR:L) with no user interaction, yielding high confidentiality impact but no integrity or availability impact - consistent with a data-extraction-only injection. No EPSS score was provided in the input, no CISA KEV listing is present, no SSVC decision data was supplied, and no public exploit code is referenced (the only links are the Wordfence advisory and the WordPress.org changeset), so exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - there is no network-vs-local conflict - but the practical risk is moderated by the authentication requirement: an attacker must first obtain a plugin account with at least custom-level privileges, which limits opportunistic mass exploitation. This is a genuine but bounded issue: real confidentiality risk (full database read via UNION/stacked queries) yet gated behind authenticated access, so it ranks as a medium priority rather than an emergency, pending patch deployment. No EPSS or KEV data is available to further calibrate exploitation likelihood.

An attacker who holds or registers a plugin account with custom-level access or higher sends a crafted value in the 'data_fields_list' parameter to the WP Directory Kit endpoint, appending malicious SQL to the existing query. Because the parameter is insufficiently escaped and the query is not properly prepared, the injected clauses execute against the WordPress database, allowing extraction of sensitive data such as user credentials, hashes, and secret keys. No public exploit code is referenced in the provided data, though the vulnerability is straightforward to weaponize given authenticated access.