A vulnerability, which was classified as critical, was found in WP Directory Kit Plugin up to 1.4.7 on WordPress. The affected element is an unknown function. Such manipulation of the argument hide_fields/attr_search leads to sql injection.
This vulnerability is traded as CVE-2025-13089. The attack may be launched remotely. There is no exploit available.
