# CVE-2026-16594: WP Directory Kit authorization bypass in AJAX settings handler

Source: https://junglewise.ai/threats/cve-2026-16594-wp-directory-kit-authorization-bypass-in-ajax-settings-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16594 · Severity: high · CVSS 7.5 · Published 2026-08-08

WP Directory Kit is a WordPress plugin used to create and manage business directories on WordPress sites. The plugin improperly validates user permissions on an AJAX endpoint, allowing any logged-in user—even those with minimal privileges (Subscriber role)—to retrieve sensitive plugin configuration including API keys for services like reCAPTCHA and Google Maps. An attacker with a basic user account could extract these secrets and use them to compromise the directory site or associated services.

Technologies: [WP Directory Kit](https://junglewise.ai/threats/technologies/wp-directory-kit). Vendors: [WP Directory Kit](https://junglewise.ai/threats/vendors/wp-directory-kit).

## Quick answers

**Is CVE-2026-16594 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16594 being exploited in the wild.

**How severe is CVE-2026-16594?** High severity, with a CVSS score of 7.5, published 8 August 2026.

**Which products and versions are affected?** WP Directory Kit before 1.5.5.

**Is there a fix for CVE-2026-16594?** A patch was published on 2026-08-08. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16594 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-16594?** Check whether you run WP Directory Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass caused by missing permission and nonce validation in an authenticated AJAX action handler (wdk_admin_action). An attacker with any authenticated user account (e.g., Subscriber role) can POST to admin-ajax.php with specific parameters to trigger the settings-page rendering without proper authorization checks. The vulnerable code falls through to a display branch that renders plugin settings containing sensitive data (API keys, secrets) in plain HTML. This is exploitable because WordPress authentication alone does not enforce role-based access control; the plugin must explicitly check capabilities. A patch is available in version 1.5.5 and later.

## Affected products

- WP Directory Kit WP Directory Kit before 1.5.5

## Timeline

- 2026-08-03: disclosed
- 2026-08-08: patched

## References

- [https://wpscan.com/vulnerability/d055d385-7e8a-4179-aa21-f07e240fd181/](https://wpscan.com/vulnerability/d055d385-7e8a-4179-aa21-f07e240fd181/)

## Related threats

- [WP Directory Kit SQL injection in order parameter](https://junglewise.ai/threats/cve-2026-118421-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not)
- [WP Directory Kit SQL injection via main_field parameter](https://junglewise.ai/threats/cve-2026-118420-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not)
- [WP Directory Kit unauthenticated data disclosure](https://junglewise.ai/threats/cve-2026-118418-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not)
- [WP Directory Kit SQL injection in idfield parameter](https://junglewise.ai/threats/cve-2026-109197-the-wp-directory-kit-plugin-for-wordpress-is-vulnerable-to)
- [WP Directory Kit SQL injection in data_fields_list parameter](https://junglewise.ai/threats/cve-2026-16596-the-wp-directory-kit-plugin-for-wordpress-is-vulnerable-to)