Executive brief
WP Directory Kit is a WordPress plugin for creating business directory listings. The plugin fails to properly check user permissions in its shortcodes, allowing contributors (a low-level user role) to view private, password-protected, and hidden listing data belonging to other users. This can expose sensitive information like property details, contact fields, and other confidential data stored in directory listings.
Technical details
The vulnerability is an authorization bypass in the wdk-listing-field-value shortcode that fails to verify whether the requesting user has permission to view specific listing fields or whether those fields should be visible. A Contributor-level user can craft a shortcode with a target listing ID (which are sequentially enumerable) and arbitrary field IDs to extract non-public content, including password-protected values and fields marked invisible on the frontend. The attack requires only contributor privileges and knowledge of a listing ID; the shortcode renders the sensitive data in draft post previews. No fix is currently available as of the advisory date (2026-09-23).
Affected products
- WP Directory Kit WP Directory Kit through 1.5.9
Timeline
- 2026-09-12: disclosed
- 2026-09-15: advisory