CVE-2026-28001

The 9.3 CVSS and 0.00291 EPSS on this WordPress plugin SQL injection should not be reconciled — they measure different things, and the gap tells you more about your own environment than about the vulnerability's intrinsic risk. CVSS 9.3 reflects worst-case assumptions: unauthenticated, network-adjacent, total database exposure. For WP Directory Kit <= 1.5.4, that worst case is real — the plugin has direct access to wp_options and wp_users tables, meaning successful exploitation yields authentication tokens, admin credentials, and the ability to inject malicious code into site content. This isn't abstract data leakage; it's site takeover. EPSS at 0.3% reflects today's weaponization state, not tomorrow's. WordPress plugin SQL injections follow a well-documented lifecycle: low EPSS at disclosure, rapid signature adoption by scanners (Wordfence, WPScan), and then a weaponization spike that has nothing to do with exploit difficulty and everything to do with target accessibility. The plugin ecosystem's low barrier to entry means exploitation modules appear in automated toolkits within days of public discussion. The EPSS figure is a snapshot, not a trajectory. What neither score captures is the blast radius. If exploitation succeeds, the attacker doesn't just read database rows — they own the WordPress installation's authentication infrastructure. Every visitor to that site becomes a potential malware distribution target. Every other plugin's configuration becomes readable. The CVSS calls this "High" confidentiality impact; the word does no analytical work. In practice, it means your site becomes attacker infrastructure. The analytical mistake is treating this as a triage problem: patch now or patch later based on EPSS thresholds. The real question is simpler and more uncomfortable: how long has your organization been running an unauthenticated SQL injection with admin-credential access? The CVSS tells you the severity. The EPSS tells you about attacker prioritization. Neither tells you about your own remediation debt — the gap between disclosure and your actual patch deployment. In the WordPress plugin ecosystem, that gap is where exploitation actually happens, and it has nothing to do with EPSS. Check yourwp_options table access patterns, verify whether your hosting environment is shared (which introduces lateral risk the CVSS cannot model), and treat this as a standard-priority patch — not because EPSS is low, but because the window between disclosure and weaponization in this ecosystem is measured in days, not weeks.

Reviewed through automated stages and approved by a human before publication.