Executive brief
WP Directory Kit is a WordPress plugin for managing business directory listings. An authentication flaw allows any logged-in user with low privileges (such as a Subscriber) to access sensitive information they should not see, including the full list of all site user accounts and draft/unapproved listings from other users. This information disclosure could help an attacker learn about unpublished business content or identify administrator accounts.
Technical details
The plugin fails to perform authorization (capability) checks and nonce validation on an authenticated AJAX action (wdk_admin_action with page=wdk and function=index). While the action requires authentication (a valid WordPress session), it does not verify that the requesting user has permission to access administrative functions. An attacker with a Subscriber account can POST directly to admin-ajax.php and receive the Listings Management grid HTML, which reveals all site users including administrators and displays titles of unpublished/unapproved directory listings from other users. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The plugin was patched in version 1.5.5.
Affected products
- WP Directory Kit WP Directory Kit before 1.5.5
Timeline
- 2026-08-03: disclosed
- 2026-08-08: patched: Fixed in version 1.5.5