CVE-2026-18231 is an information exposure vulnerability (CWE-200) in the WP Directory Kit WordPress plugin versions prior to 1.5.7. The vulnerability exists because the plugin fails to enforce authorization on a public AJAX action, which returns unfiltered database rows. This allows unauthenticated attackers to obtain sensitive user information, specifically usernames and email addresses of users with roles defined by the plugin.

Unauthenticated attackers can retrieve usernames and email addresses of users holding WP Directory Kit plugin roles. This exposure of sensitive user information could facilitate further attacks such as phishing or targeted social engineering but does not directly allow privilege escalation or code execution based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 1.5.7, upgrading to version 1.5.7 or later is likely recommended once confirmed. Until then, restrict access to the affected AJAX actions if possible or disable the plugin if the risk is unacceptable.