WP Directory Kit <= 1.5.9 – Unauthenticated Unpublished Listing Disclosure via search_suggestion | CVE 2026-18232

Description

The plugin does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.

Proof of Concept

Prerequisite: a directory listing that is not publicly readable. Listing IDs are sequential and enumerable, and a listing needs its corresponding wp_wdk_listings_fields row to be returned, which every listing created through the plugin has.

Up to and including 1.5.6, any draft or unapproved listing works:

POST /wp-admin/admin-ajax.php
Content-Type: application/x-www-form-urlencoded

action=wdk_public_action&page=wdk_frontendajax&function=map_infowindow&listing_post_id=4

On 1.5.7 the listing must be one that was approved and then unpublished, which is the normal state of a listing an owner or administrator has taken down. Set is_activated and is_approved to 1 and leave the WordPress post as draft, pending, private, future or trash, then send the same unauthenticated POST, with no cookies:

action=wdk_public_action&page=wdk_frontendajax&function=map_infowindow&listing_post_id=21

Expected result: HTTP 200 with a JSON body whose popup_content carries the target listing's title and content, for a listing that returns HTTP 404 when requested directly, including to a logged-in Subscriber.

Iterate listing_post_id to enumerate other users' unpublished listings. The map_infowindow_dash action behaves the same way on 1.5.7, and search_suggestion additionally returns the listing's direct URL:

action=wdk_public_action&page=wdk_frontendajax&function=search_suggestion&search=Road