CVE-2026-42720
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The Dynamic User Directory plugin by Sarah Giles contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. This issue affects versions up to and including 2.4.
Risk Assessment
An attacker can execute SQL queries without administrator knowledge, potentially leading to data leakage or database manipulation.
Recommendation
Update the Dynamic User Directory plugin to a version newer than 2.4 if available, or apply other mitigations.
Other vulnerabilities in Dynamic User Directory
See all- CVE-2026-42719Critical
The Dynamic User Directory plugin in versions up to and including 2.4 contains a PHP Object Injection vulnerability exploitable by a Subscriber-level user. Only a low-privileged account is required.
- CVE-2025-62982Medium
The Dynamic User Directory (dynamic-user-directory) plugin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), allowing Stored XSS. This issue affects Dynamic User Directory from n/a through <= 2.3.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS