CVE-2026-16595 PUBLISHED

WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure

Assigner: WPScan
Reserved: 22.07.2026 Published: 08.08.2026 Updated: 08.08.2026

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.

Product Status

Vendor Unknown
Product WP Directory Kit
Versions Default: unaffected
  • affected from 0 to 1.5.5 (excl.)

Credits

  • Yaswanth Reddy Sunkara finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE