CVE-2026-14785 describes a SQL Injection vulnerability (CWE-89) in the Web Directory Free WordPress plugin by mihail-chepovskiy. The issue arises from improper neutralization of special elements in the 'levels' parameter, which is insufficiently escaped and not properly prepared in SQL queries. This allows unauthenticated attackers to append malicious SQL code to existing queries, potentially exposing sensitive database information. The vulnerability affects all versions up to and including 1.7.13. There is no vendor advisory or patch currently available.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability according to the CVSS vector, but confidentiality is rated high. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin or applying custom mitigations such as input validation or web application firewall rules targeting the 'levels' parameter to block malicious input.