CVE-2026-16592 in WP Directory Kit Plugin
Summary
by MITRE • 09/15/2026
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in the WP Directory Kit WordPress plugin versions through 1.5.7 represents a critical failure in access control mechanisms within the application's shortcode processing logic. This flaw allows for unauthorized disclosure of sensitive information by bypassing standard permission checks that are typically enforced to protect user-generated content and private data fields. The core issue lies in the specific implementation of shortcodes used to display directory listings, where the code fails to verify whether the requesting user has sufficient privileges or ownership rights to view the requested listing details. This lack of authorization enforcement means that any authenticated user with a Contributor role or lower can exploit this gap to access data intended for administrators, editors, or other specific users who have marked their content as private or password-protected.
From a technical perspective, the vulnerability stems from an improper implementation of object-level permissions within the plugin's PHP codebase. When a shortcode is invoked to render listing information, the system retrieves and displays fields without adequately checking if the current user session possesses the necessary capabilities defined by WordPress roles such as Editor or Administrator. Furthermore, the logic does not respect visibility flags set on individual listings, including those marked with password protection or hidden status indicators. This oversight effectively neutralizes the security controls provided by the platform's native role-based access control system and the plugin's own privacy settings, creating a direct path for information leakage.
The operational impact of this vulnerability is significant, particularly in environments where user-generated content includes sensitive personal data, business contact details, or proprietary information. Attackers with low-privileged accounts can systematically enumerate listings and extract non-public fields belonging to other users. This capability facilitates unauthorized surveillance of competitor activities, theft of intellectual property, or potential preparation for more targeted attacks such as social engineering or credential stuffing if additional identifying information is exposed. The exposure of password-protected content further compounds the risk, as it may reveal underlying security configurations or sensitive data that was intended to be shielded from general public view.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor under the Common Weakness Enumeration standard. In terms of adversary tactics, it corresponds to ATT&CK technique T1530 Data from Cloud Storage Objects or more broadly T1005 Data from Local System depending on how the data is stored and accessed, specifically relating to unauthorized access to restricted resources. The exploitation does not require complex injection techniques but rather relies on simple HTTP requests that trigger the vulnerable shortcode with appropriate parameters pointing to target listing IDs.
Mitigation strategies should focus primarily on immediate patching of the WP Directory Kit plugin to a version later than 1.5.7 where these authorization checks have been corrected by the developers. Until an update is available, administrators can implement temporary workarounds such as restricting access to specific pages or shortcodes using server-level rules if possible, although this may be difficult given WordPress's dynamic nature. It is also advisable to audit user roles and ensure that only trusted individuals are assigned Contributor levels in production environments where sensitive directory data exists. Regular security audits of custom plugins and strict adherence to principle of least privilege for all user accounts will help reduce the attack surface associated with such access control flaws.