CVE-2026-16595 is an information exposure vulnerability (CWE-200) in the WP Directory Kit WordPress plugin. Versions prior to 1.5.5 do not enforce proper authorization or nonce validation on one of their authenticated AJAX actions. This flaw enables any authenticated user, regardless of privilege level, to disclose sensitive information such as the full user list and unpublished listings owned by other users on the site.

The vulnerability allows unauthorized disclosure of sensitive site data, including the user list and unpublished content. This exposure could lead to privacy violations and potentially aid attackers in further targeting or reconnaissance activities. However, exploitation requires the attacker to be an authenticated user on the site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious activity involving AJAX requests. Avoid granting unnecessary authenticated access to untrusted users.