CVE-2026-42720: WordPress Dynamic User Directory plugin <= 2.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
WordPress sites that have the Sarah Giles Dynamic User Directory plugin installed in an affected version, through 2.4, are exposed. Exploitation requires an attacker to already hold high privileges.
What does an attacker need to exploit it?
The vulnerability is remotely reachable over the network, requires low attack complexity, and does not require user interaction. However, the attacker must have high privileges.
What is the expected impact if exploitation succeeds?
The CVSS vector indicates high confidentiality impact and low availability impact, with no integrity impact. The scope is changed, meaning the vulnerable component may affect resources beyond its own security authority.