WordPress Plugin Vulnerabilities

WP Directory Kit < 1.6.3 - Unauthenticated User Data and Contact Message Disclosure

Description

The plugin does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and private contact-form submissions.

Proof of Concept

Affects Plugins

Plugin icon
wpdirectorykit
Fixed in 1.6.3

References

CVE
CVE-2026-118418

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Rangga Ardhi Saputra
Submitter
Rangga Ardhi Saputra
Verified
Yes
WPVDB ID
faef9089-6d62-42f4-b507-3c6cc804296a

Timeline

Publicly Published
2026-11-09 (about 2 days ago)
Added
2026-11-09 (about 1 day ago)
Last Updated
2026-11-09 (about 1 day ago)

Other

Published
Title
Published
2026-10-02
Title
Cost Calculator Builder < 4.0.18 - Unauthenticated Information Exposure
Published
2026-03-27
Title
Ninja Forms < 3.14.2 - Contributor+ Sensitive Information Disclosure via Block Editor Token
Published
2026-09-28
Title
Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes
Published
2024-12-05
Title
WP Private Content Plus < 3.6.2 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Published
2026-03-17
Title
Nelio AB Testing < 8.3.0 - Unauthenticated Information Exposure