CVE-2026-28001 is an unauthenticated SQL Injection vulnerability (CWE-89) in WP Directory Kit affecting versions up to 1.5.4. The flaw arises from improper neutralization of special elements used in SQL commands, enabling attackers to inject malicious SQL queries. The vulnerability has a CVSS 3.1 base score of 9.3, reflecting critical severity with network attack vector, no required privileges, and no user interaction. The impact includes complete confidentiality loss and partial availability impact. No vendor advisory or patch information is available to confirm remediation status.

An unauthenticated attacker can exploit this SQL Injection vulnerability to execute arbitrary SQL commands on the backend database. This can lead to full disclosure of sensitive data (confidentiality impact is high) and potentially disrupt service availability (availability impact is low). Integrity impact is not indicated. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting WP Directory Kit. Monitor for updates from the vendor regarding patches or official mitigations.