CVE-2025-13138

Deeper analysis

The WP Directory Kit plugin for WordPress is vulnerable to SQL injection in all versions through 1.4.3. The flaw exists in the select_2_ajax() function, where the columns_search parameter is used in a database query without adequate escaping or prepared statements, allowing an attacker to alter the query structure. The issue is tracked as CVE-2025-13138 and carries a CVSS 3.1 base score of 7.5 under CWE-89.

Unauthenticated attackers can reach the vulnerable endpoint over the network and supply crafted input to the columns_search parameter. Successful exploitation permits the attacker to append arbitrary SQL to existing queries, resulting in the extraction of sensitive data from the WordPress database.

Public references include the plugin source on WordPress Trac, a changeset that addresses the affected file, the official plugin directory page, and a detailed Wordfence advisory; these indicate that site operators should apply the vendor-supplied update that corrects the query handling.

The EPSS probability rose from a low starting value to a peak of 0.2765 on 2026-02-06 before receding to the current 0.1235, showing increased exploitation interest after disclosure.