Dynamic User Directory
Monthly
PHP object injection in the Dynamic User Directory WordPress plugin (versions 2.4 and earlier) allows an attacker holding a low-privileged account to feed attacker-controlled serialized data into an unserialize() call, potentially enabling arbitrary file operations, data disclosure, or remote code execution if a usable POP gadget chain exists within the plugin, WordPress core, or a co-installed plugin. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N), but our independent assessment lowers the privileges-required metric to Low (PR:L) because the Patchstack 'Subscriber' designation means the attacker must already hold a subscriber-level WordPress account; sites that disable open user registration substantially limit exposure. No public exploit code or confirmed active exploitation was identified at time of analysis.
Blind SQL injection in the Sarah Giles 'Dynamic User Directory' WordPress plugin, affecting all versions up to and including 2.4, lets an attacker with an existing high-privilege account on the target WordPress site inject arbitrary SQL into a plugin query and exfiltrate database contents by observing boolean or timing differences in responses, since the query results are not returned directly. The flaw is remotely reachable with low attack complexity and no user interaction, but the CVSS:3.1/AV:N/AC:L/PR:H/UI:N vector means it is only exploitable by an authenticated, high-privilege user - a significant limiting factor that narrows the realistic attacker set to trusted administrators or attackers who have already compromised a privileged account. Our independent assessment scores the issue 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N), lower than the 7.6 reported by the finder, because scope is unchanged and integrity and availability impact are limited; there is no CISA KEV listing and no public exploit identified at time of analysis, although a Patchstack advisory documents the issue.
PHP object injection in the Dynamic User Directory WordPress plugin (versions 2.4 and earlier) allows an attacker holding a low-privileged account to feed attacker-controlled serialized data into an unserialize() call, potentially enabling arbitrary file operations, data disclosure, or remote code execution if a usable POP gadget chain exists within the plugin, WordPress core, or a co-installed plugin. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N), but our independent assessment lowers the privileges-required metric to Low (PR:L) because the Patchstack 'Subscriber' designation means the attacker must already hold a subscriber-level WordPress account; sites that disable open user registration substantially limit exposure. No public exploit code or confirmed active exploitation was identified at time of analysis.
Blind SQL injection in the Sarah Giles 'Dynamic User Directory' WordPress plugin, affecting all versions up to and including 2.4, lets an attacker with an existing high-privilege account on the target WordPress site inject arbitrary SQL into a plugin query and exfiltrate database contents by observing boolean or timing differences in responses, since the query results are not returned directly. The flaw is remotely reachable with low attack complexity and no user interaction, but the CVSS:3.1/AV:N/AC:L/PR:H/UI:N vector means it is only exploitable by an authenticated, high-privilege user - a significant limiting factor that narrows the realistic attacker set to trusted administrators or attackers who have already compromised a privileged account. Our independent assessment scores the issue 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N), lower than the 7.6 reported by the finder, because scope is unchanged and integrity and availability impact are limited; there is no CISA KEV listing and no public exploit identified at time of analysis, although a Patchstack advisory documents the issue.