This vulnerability, identified as CWE-89, is an unauthenticated SQL Injection flaw in WP Directory Kit versions <= 1.5.4. It arises from improper neutralization of special elements used in SQL commands, allowing attackers to manipulate database queries. The CVSS v3.1 score is 7.5, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and a scope change with high confidentiality impact but no integrity impact and low availability impact. No known exploits are reported in the wild, and no official remediation or patch information is currently available.

Successful exploitation could lead to unauthorized disclosure of sensitive information from the database due to the high confidentiality impact. The vulnerability does not affect data integrity but may cause limited availability impact. Since the attack requires no privileges or user interaction, it poses a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as restricting access to vulnerable endpoints or employing web application firewalls to detect and block SQL injection attempts.