CVE-2026-16590 is an information exposure vulnerability (CWE-200) in the WP Directory Kit WordPress plugin prior to version 1.5.5. The flaw arises because the plugin does not enforce authorization or nonce verification on one of its authenticated AJAX actions. As a result, any authenticated user, regardless of role privileges, can retrieve stored contact messages and associated user data belonging to other users. This exposure compromises confidentiality but does not affect integrity or availability.

The vulnerability allows unauthorized disclosure of sensitive user data and contact messages to any authenticated user, including those with minimal privileges such as Subscribers. This can lead to privacy violations and potential misuse of exposed information. There is no indication of impact on data integrity or service availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles that can authenticate or disable the vulnerable AJAX action if possible. Monitor vendor channels for updates and apply patches promptly once released.