WP Directory Kit CVE-2026-16594

The target site must have WP Directory Kit installed and active on a version prior to 1.5.5. The attacker must possess any valid authenticated WordPress session, including the default Subscriber role, which requires only completing standard account registration if site membership is enabled (WordPress Settings > General > Anyone can register). No elevated privileges, administrator access, or knowledge of internal site configuration are required beyond a live authenticated session cookie. Exploitation is bounded by the need for authentication: sites with user registration disabled and no externally granted accounts are not exposed to unauthenticated remote exploitation. The published CVSS PR:N designation appears to be a scoring error inconsistent with the description's authenticated requirement, and defenders should not treat this as a fully unauthenticated attack surface.

The NVD-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) designates no authentication required, but the CVE description explicitly states access is limited to authenticated users - a direct conflict that inflates the published score. The more accurate metric is PR:L, which would reduce the effective base score and better reflect real exploitation prerequisites. EPSS at 0.14% (4th percentile) signals very low probability of widespread exploitation despite the publicly available POC, suggesting the attack remains largely targeted or opportunistic rather than automated at scale; even a mid-sized municipal IT team in koszalin should treat this as urgent if user registration is open on their site and the plugin stores keys for billing or communications APIs. No CISA KEV listing means active exploitation campaigns are not confirmed. The true risk magnitude depends on the downstream services whose keys are stored in plugin settings - exposure of a Google Maps key is inconvenient, but exposure of payment processor or SMTP credentials carries significant secondary impact.

An attacker registers a free Subscriber account on a WordPress site running WP Directory Kit before 1.5.5 - or uses any existing low-privilege credentials - and submits an authenticated POST request to wp-admin/admin-ajax.php targeting the unprotected AJAX action. The server responds with the plugin's configuration, including stored API keys for third-party services integrated into the directory. A publicly available proof-of-concept from WPScan makes this exploitable with minimal technical skill.