The WP Directory Kit WordPress plugin prior to version 1.5.5 does not enforce authorization or nonce verification on one of its authenticated AJAX actions. This security weakness enables any authenticated user, regardless of privilege level, to retrieve sensitive configuration data from the plugin, including API keys and secrets. The vulnerability is classified as CWE-200 (Information Exposure) and has a CVSS 3.1 base score of 7.5, indicating a high severity level. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

An attacker with any authenticated WordPress user account can disclose sensitive plugin settings, including API keys and secrets. This exposure could lead to further compromise depending on how these secrets are used, but the vulnerability itself does not allow privilege escalation or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles to trusted users only and monitor for suspicious activity related to the plugin's AJAX actions.