CVE-2026-16595: CWE-200 Information Exposure in WP Directory Kit
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
AI Analysis
Technical Summary
CVE-2026-16595 is an information exposure vulnerability (CWE-200) in the WP Directory Kit WordPress plugin. Versions prior to 1.5.5 fail to enforce authorization and nonce verification on a particular authenticated AJAX action. As a result, any authenticated user, regardless of privilege level, can retrieve sensitive data including the full user list and unpublished listings of other users. This flaw compromises confidentiality but does not affect integrity or availability.
Potential Impact
The vulnerability allows disclosure of sensitive site information such as the user list and unpublished user listings to any authenticated user, including those with minimal privileges. This can lead to privacy violations and potential reconnaissance for further attacks. There is no indication of impact on data integrity or service availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles or monitor access to AJAX actions if possible. Avoid granting unnecessary authenticated access to untrusted users.
CVE-2026-16595: CWE-200 Information Exposure in WP Directory Kit
Description
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
CVSS v3.1
Score 6.5medium
Affected software
WP Directory Kit
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16595 is an information exposure vulnerability (CWE-200) in the WP Directory Kit WordPress plugin. Versions prior to 1.5.5 fail to enforce authorization and nonce verification on a particular authenticated AJAX action. As a result, any authenticated user, regardless of privilege level, can retrieve sensitive data including the full user list and unpublished listings of other users. This flaw compromises confidentiality but does not affect integrity or availability.
Potential Impact
The vulnerability allows disclosure of sensitive site information such as the user list and unpublished user listings to any authenticated user, including those with minimal privileges. This can lead to privacy violations and potential reconnaissance for further attacks. There is no indication of impact on data integrity or service availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles or monitor access to AJAX actions if possible. Avoid granting unnecessary authenticated access to untrusted users.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-22T13:47:43.066Z
- State
- PUBLISHED
Threat ID: 6a76cc2cbf8831d53911475d
Added to database: 08/08/2026, 06:26:52 UTC
Last enriched: 08/15/2026, 15:12:07 UTC
Last updated: 09/22/2026, 13:47:43 UTC
Views: 51
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.