Executive brief
WP Directory Kit is a WordPress plugin for managing business directory listings. The plugin fails to properly validate access to listing content, allowing unauthenticated attackers to view draft and unpublished listings that should only be visible to authorized users. This could expose sensitive business information, contact details, and other private listing data to unauthorized parties.
Technical details
The vulnerability is an information disclosure (CWE-200) in the WP Directory Kit plugin's public AJAX actions, specifically in the map_infowindow, map_infowindow_dash, and search_suggestion functions. The plugin fails to verify listing status or ownership before returning content through these endpoints. An unauthenticated attacker can enumerate listing IDs sequentially and use POST requests to /wp-admin/admin-ajax.php with parameters like action=wdk_public_action&page=wdk_frontendajax&function=map_infowindow to retrieve draft, pending, private, or trashed listings. No authentication or user interaction is required. The attack is mitigated somewhat in version 1.5.7 (limiting exposure to previously approved but unpublished listings), but the vulnerability persists. Patches appear to be unavailable as of the published date.
Affected products
- wpdirectorykit WP Directory Kit through 1.5.9
Timeline
- 2026-09-12: disclosed
- 2026-09-15: advisory