CVE-2025-13089 is an SQL Injection vulnerability in the WP Directory Kit plugin for WordPress affecting all versions up to 1.4.7. The issue arises from improper neutralization of special elements in the 'hide_fields' and 'attr_search' parameters, allowing unauthenticated attackers to append malicious SQL code to existing queries. This is due to insufficient escaping of user-supplied input and lack of prepared statements in the plugin's SQL handling. The vulnerability can be exploited remotely without authentication, potentially exposing sensitive database information. No known exploits are reported in the wild, and no patch or official fix has been documented as of the published date.

Successful exploitation allows unauthenticated attackers to perform SQL Injection attacks, enabling them to extract sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. The CVSS 3.1 base score of 7.5 reflects high severity due to network attack vector, no privileges required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the WP Directory Kit plugin or restricting access to vulnerable parameters via web application firewalls or other filtering mechanisms. Monitor vendor channels for updates and apply patches promptly once released.