A critical SQL injection vulnerability in the WP Directory Kit WordPress plugin enables unauthenticated attackers to compromise sensitive database information.

The plugin fails to properly sanitize and escape input parameters before incorporating them into SQL statements. This lack of input validation allows an unauthenticated attacker to manipulate database queries to extract or potentially modify sensitive information.

With a CVSS score of 9.1, this vulnerability is classified as critical. Successful exploitation could lead to full database compromise, including the unauthorized access of user credentials, sensitive configuration data, and customer records. The potential for total information disclosure presents a severe risk to organizational operations and data integrity.

Immediate Action: Update the WP Directory Kit plugin to version 1.5.5 or later immediately.

Proactive Monitoring: Monitor database query logs for suspicious syntax or unexpected patterns that indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to detect and block common SQL injection patterns in HTTP requests.

Public Exploit Available: Yes, public proof-of-concept exploits are available.

This vulnerability represents a critical threat to the confidentiality and integrity of the affected site. Organizations using this plugin must apply the vendor patch immediately to mitigate the risk of an unauthenticated database compromise.