WordPress Plugin Vulnerabilities

WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow

Description

The plugin does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.

Proof of Concept

Affects Plugins

Plugin icon
wpdirectorykit
No known fix

References

CVE
CVE-2026-18232

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
69d10ee3-0d36-47d1-b5bf-88b8516d99f4

Timeline

Publicly Published
2026-09-12 (about 2 days ago)
Added
2026-09-05 (about 9 days ago)
Last Updated
2026-09-05 (about 9 days ago)

Other

Published
Title
Published
2024-01-16
Title
SalesKing < 1.6.30 - Unauthenticated Sensitive Information Exposure
Published
2026-09-14
Title
Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output
Published
2026-02-02
Title
Tutor LMS < 3.9.6 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
Published
2025-09-05
Title
Ninja Charts < 3.3.6 - Unauthenticated Information Exposure
Published
2025-11-10
Title
Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State