{"id":"CVE-2026-42720","published":"2026-10-07T10:17:35.743","lastModified":"2026-10-07T13:24:53.103","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/dynamic-user-directory/vulnerability/wordpress-dynamic-user-directory-plugin-2-4-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to perform blind SQL injection attacks against the Dynamic User Directory plugin, potentially enabling them to extract data from the database through carefully crafted SQL commands. The flaw occurs due to improper neutralization of special elements in SQL commands.","exploitability":"Exploitation requires a high-privilege user account (PR:H) and is moderately difficult to execute, as it relies on blind SQL injection techniques that require multiple requests to extract data.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive user data, including potentially personal information and authentication credentials stored in the database.","remediation":"Upgrade to version 2.5 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","database"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:01:34.315Z"}}