CVE-2026-16595 in WP Directory Kit Plugin
Summary
by MITRE • 08/08/2026
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/08/2026
The WP Directory Kit WordPress plugin vulnerability represents a critical authorization flaw that undermines the security model of WordPress sites relying on this plugin. This issue affects versions prior to 1.5.5 and stems from insufficient access control mechanisms within the plugin's AJAX handling system. The vulnerability allows any authenticated user account, regardless of role level, to exploit a specific endpoint that should only be accessible to administrators or privileged users. The flaw manifests through the absence of proper nonce validation and authorization checks on an authenticated AJAX action, creating an unintended information disclosure channel within the WordPress ecosystem.
The technical implementation of this vulnerability involves the plugin's failure to validate user permissions before processing requests to retrieve sensitive data through AJAX endpoints. When an authenticated user accesses the vulnerable endpoint, the system does not verify whether the requesting user possesses adequate privileges to access the requested information. This oversight creates a direct pathway for privilege escalation and unauthorized data access, as the system treats all authenticated users equally regardless of their role or permissions within the WordPress site. The vulnerability specifically impacts the disclosure of user lists and unpublished listings, which contain potentially sensitive information about other users and content that should remain private.
The operational impact of this vulnerability extends beyond simple information disclosure to encompass potential privacy violations and data exposure risks for WordPress site administrators and their users. A subscriber-level account can leverage this flaw to obtain comprehensive user directories and access unpublished content that would normally be restricted to administrators or editors. This creates a significant risk for sites with sensitive listings or user data, as the vulnerability enables unauthorized access to potentially confidential information about other users and unpublished content. The implications are particularly severe in environments where the directory plugin serves as a primary means of user engagement or business listing management.
From a cybersecurity perspective, this vulnerability aligns with CWE-863, which addresses "Incorrect Authorization" issues in software systems. The flaw demonstrates poor access control implementation that violates fundamental security principles of least privilege and proper authentication mechanisms. Additionally, this vulnerability could be categorized under ATT&CK technique T1078 which covers valid accounts for lateral movement and privilege escalation. Organizations should implement immediate mitigations including updating to WP Directory Kit version 1.5.5 or later, reviewing user role assignments, and implementing additional monitoring for suspicious AJAX activity within their WordPress installations. The vulnerability highlights the importance of regular security audits and proper input validation in plugin development, particularly for authenticated endpoints that handle sensitive data operations.