This vulnerability (CVE-2026-66649) is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the e-plugins Directory Pro product. It affects versions up to 2.5.8 and allows unauthenticated attackers to inject SQL commands. The CVSS 3.1 score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The integrity of data is not impacted according to the CVSS vector, but availability may be slightly affected. This poses a critical risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable application and monitor for suspicious activity related to SQL injection attempts.