Dynamic User Directory EUVD-2026-94263

Exploitation requires an authenticated high-privilege account on the target WordPress site (CVSS PR:H), per the provided vector - this is the primary limiting factor and substantially narrows the realistic attacker set to already-trusted or compromised privileged users. The affected component is the Dynamic User Directory plugin at versions up to and including 2.4; sites not running this plugin, or running a later fixed release, are unaffected. The flaw is remotely reachable over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), but no unauthenticated path is indicated. The specific vulnerable parameter/endpoint is not named in the provided data and should be confirmed from the Patchstack advisory.

This is a blind SQL injection (CWE-89) in the Sarah Giles 'Dynamic User Directory' WordPress plugin (versions up to and including 2.4), reported by Patchstack. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, 7.6) signals network-reachable, low-complexity exploitation but requires high privileges (PR:H), meaning the attacker must already hold an elevated authenticated role (typically administrator-level in a Patchstack plugin context) before exploitation is possible. This PR:H requirement is the single biggest risk-dampener: a flaw exploitable only by an already-privileged user is far lower real-world priority than an unauthenticated SQLi. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The signals are therefore internally consistent toward MODERATE priority: a genuine data-confidentiality bug but gated behind high privileges in a low-footprint plugin. One notable tension: the scope-change flag (S:C) and the mix of C:H/I:N/A:L is unusual for a classic blind SQLi, where one would typically expect at least some integrity impact - this specific breakdown should be verified against the Patchstack advisory rather than treated as settled.

An attacker who already holds a high-privilege authenticated account (e.g. admin or an equivalently privileged role) on a WordPress site running Dynamic User Directory ≤2.4 submits crafted input to a vulnerable plugin parameter that is concatenated unsanitized into an SQL query. Because the injection is blind, the attacker infers database contents through boolean or time-based responses, progressively extracting sensitive data such as user records or credentials hashes. No public exploit code is identified at time of analysis, so exploitation would require the attacker to develop the injection payloads independently.