An SQL injection vulnerability in the WP Directory Kit WordPress plugin allows authenticated subscribers to access or manipulate database content without authorization.

The plugin fails to sanitize and escape parameters used in SQL statements within authenticated AJAX actions. Because these actions lack authorization and nonce checks, any authenticated user, including those with Subscriber privileges, can perform SQL injection attacks.

The vulnerability carries a CVSS score of 7.7, reflecting its potential for unauthorized database access. By leveraging this flaw, an attacker could extract sensitive user information, configuration data, or escalate privileges within the WordPress environment, leading to a loss of confidentiality and system integrity.

Immediate Action: Update the WP Directory Kit plugin to version 1.5.5 or later to resolve the underlying sanitization and authorization issues.

Proactive Monitoring: Audit database query logs for suspicious patterns or queries that deviate from standard plugin operations.

Compensating Controls: Restrict access to administrative or sensitive AJAX endpoints via WAF rules and ensure that user roles are strictly managed to minimize the number of accounts capable of triggering these actions.

Public Exploit Available: No (unknown).

The ability for low-privilege users to perform SQL injection makes this a serious concern for any site using the WP Directory Kit plugin. Administrators must immediately update to version 1.5.5 and review the activity of existing user accounts to ensure no malicious activity has occurred.