CVE-2026-16590 is an information exposure vulnerability (CWE-200) in the WP Directory Kit WordPress plugin versions prior to 1.5.5. The flaw arises because the plugin does not enforce authorization or nonce verification on one of its authenticated AJAX actions. This allows authenticated users with minimal privileges to retrieve sensitive contact messages and associated user data of other users, potentially violating user privacy and confidentiality.

Any authenticated user, including those with Subscriber-level access, can access contact messages and user data of other users. This exposure of sensitive information could lead to privacy violations and potential misuse of personal data. There is no indication of remote unauthenticated exploitation or privilege escalation beyond information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the WP Directory Kit plugin updates and apply version 1.5.5 or later once available. Until a fix is confirmed, restrict plugin usage to trusted users and consider disabling the affected AJAX functionality if possible.