An authenticated SQL injection vulnerability in the WP Directory Kit WordPress plugin could allow an administrator to compromise the entire database of a multisite network.

The plugin fails to sanitize and escape parameters used in SQL queries, resulting in a SQL injection vulnerability. This requires an attacker to have administrative privileges, which are then used to execute arbitrary database commands.

The CVSS score of 7.2 highlights the severity of this issue, particularly in multisite environments. An attacker who has administrative access to one site can leverage this flaw to escape their restricted scope and read or modify data belonging to the entire network, leading to a complete compromise of the database and significant data breach potential.

Immediate Action: Update the WP Directory Kit plugin to version 1.5.7 or higher immediately.

Proactive Monitoring: Review database query logs for unusual SQL syntax or access patterns that deviate from standard plugin behavior.

Compensating Controls: Disable the plugin immediately if an update cannot be applied. Additionally, utilize a Web Application Firewall (WAF) to block common SQL injection attempts.

Public Exploit Available: No (there is no confirmed public exploit in the available data).

Administrators should update the WP Directory Kit plugin to 1.5.7 without delay. Given the potential for total database compromise in multisite configurations, this update is critical to maintaining the integrity and confidentiality of the entire WordPress network.