# CVE-2026-16595: WP Directory Kit authorization bypass in AJAX admin action

Source: https://junglewise.ai/threats/cve-2026-16595-wp-directory-kit-authorization-bypass-in-ajax-admin-action  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16595 · Severity: medium · CVSS 6.5 · Published 2026-08-08

WP Directory Kit is a WordPress plugin for managing business directory listings. An authentication flaw allows any logged-in user with low privileges (such as a Subscriber) to access sensitive information they should not see, including the full list of all site user accounts and draft/unapproved listings from other users. This information disclosure could help an attacker learn about unpublished business content or identify administrator accounts.

Technologies: [WP Directory Kit](https://junglewise.ai/threats/technologies/wp-directory-kit). Vendors: [WP Directory Kit](https://junglewise.ai/threats/vendors/wp-directory-kit).

## Quick answers

**Is CVE-2026-16595 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16595 being exploited in the wild.

**How severe is CVE-2026-16595?** Medium severity, with a CVSS score of 6.5, published 8 August 2026.

**Which products and versions are affected?** WP Directory Kit before 1.5.5.

**Is there a fix for CVE-2026-16595?** A patch was published on 2026-08-08: Fixed in version 1.5.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16595 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-16595?** Check whether you run WP Directory Kit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to perform authorization (capability) checks and nonce validation on an authenticated AJAX action (wdk_admin_action with page=wdk and function=index). While the action requires authentication (a valid WordPress session), it does not verify that the requesting user has permission to access administrative functions. An attacker with a Subscriber account can POST directly to admin-ajax.php and receive the Listings Management grid HTML, which reveals all site users including administrators and displays titles of unpublished/unapproved directory listings from other users. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The plugin was patched in version 1.5.5.

## Affected products

- WP Directory Kit WP Directory Kit before 1.5.5

## Timeline

- 2026-08-03: disclosed
- 2026-08-08: patched: Fixed in version 1.5.5

## References

- [https://wpscan.com/vulnerability/e960f5b2-18e9-436b-8828-6a105c7f9dd5/](https://wpscan.com/vulnerability/e960f5b2-18e9-436b-8828-6a105c7f9dd5/)

## Related threats

- [WP Directory Kit SQL injection in order parameter](https://junglewise.ai/threats/cve-2026-118421-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not)
- [WP Directory Kit SQL injection via main_field parameter](https://junglewise.ai/threats/cve-2026-118420-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not)
- [WP Directory Kit unauthenticated data disclosure](https://junglewise.ai/threats/cve-2026-118418-the-wp-directory-kit-wordpress-plugin-before-1-6-3-does-not)
- [WP Directory Kit SQL injection in idfield parameter](https://junglewise.ai/threats/cve-2026-109197-the-wp-directory-kit-plugin-for-wordpress-is-vulnerable-to)
- [WP Directory Kit SQL injection in data_fields_list parameter](https://junglewise.ai/threats/cve-2026-16596-the-wp-directory-kit-plugin-for-wordpress-is-vulnerable-to)