CVE-2026-16594 in Directory Kit Plugin
Summary
by MITRE • 08/08/2026
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/08/2026
The WP Directory Kit WordPress plugin vulnerability represents a critical authorization flaw that undermines the security posture of WordPress installations. This issue affects versions prior to 1.5.5 and stems from the plugin's failure to implement proper access controls on authenticated AJAX endpoints. The vulnerability is particularly concerning because it allows any authenticated user account, regardless of role level, to exploit the missing authorization checks and gain access to sensitive configuration data.
The technical flaw manifests in the plugin's handling of AJAX requests where nonce validation and capability checks are absent or improperly implemented. When an authenticated user makes a request to a specific AJAX action endpoint, the system should verify that the user has appropriate permissions and that the request originates from a legitimate source through nonce verification. However, this validation mechanism is completely missing or bypassed in the affected plugin versions, creating an unauthorized access vector for any logged-in user.
This vulnerability falls under the CWE-863 category of "Incorrect Authorization" and aligns with ATT&CK technique T1213.002 which covers data from information repositories. The operational impact extends beyond simple information disclosure as the exposed settings may contain sensitive API keys, secrets, and other configuration parameters that could be leveraged for further exploitation. An attacker with a subscriber-level account can extract these credentials and potentially use them to compromise additional systems or escalate privileges within the WordPress environment.
The security implications of this vulnerability are significant because it creates an attack surface that requires minimal privileges to exploit. Any user who can log into the WordPress site, including subscribers, contributors, or even editors, can access sensitive configuration data without proper authorization. This weakness can lead to credential exposure, service disruption, and potential lateral movement within the affected environment. The vulnerability demonstrates a fundamental failure in secure coding practices where authentication checks are not properly enforced on all endpoints that handle sensitive operations.
Organizations using WP Directory Kit plugin versions prior to 1.5.5 should immediately implement mitigations including updating to the patched version, implementing additional access controls at the web server level, and monitoring for unauthorized access attempts. The patch addresses the missing authorization checks by implementing proper capability validation and nonce verification mechanisms that ensure only users with appropriate permissions can access sensitive plugin configuration data through AJAX endpoints. Security teams should also conduct comprehensive audits of other WordPress plugins to identify similar authorization flaws that could present similar risks to their environments.