CVE-2026-42720

Summary

This vulnerability allows attackers to perform blind SQL injection attacks against the Dynamic User Directory plugin, potentially enabling them to extract data from the database through carefully crafted SQL commands. The flaw occurs due to improper neutralization of special elements in SQL commands.

Exploitability

Exploitation requires a high-privilege user account (PR:H) and is moderately difficult to execute, as it relies on blind SQL injection techniques that require multiple requests to extract data.

Blast radius

If exploited, this vulnerability could allow attackers to access sensitive user data, including potentially personal information and authentication credentials stored in the database.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 2.5 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.