WP Directory Kit CVE-2026-39534

Target must be a WordPress site running the WP Directory Kit plugin at version 1.5.0 or earlier, with the vulnerable endpoint reachable over HTTP/HTTPS - no authentication, user interaction, or special site configuration is required per CVSS PR:N/UI:N/AC:L. Exploitation is limited to confidentiality impact (CVSS C:H, I:N, A:N), so it does not by itself allow modification or denial of service; sites that do not have the plugin installed or that have already upgraded past 1.5.0 are not exposed.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields 7.5 and describes a network-reachable, low-complexity, no-auth, no-interaction issue with high confidentiality impact only - consistent with reading data that should be access-controlled. EPSS, KEV and SSVC data were not provided, and no public PoC was referenced, so real-world exploitation pressure cannot be quantified from the inputs; however, WordPress plugin broken-access-control bugs are routinely mass-scanned shortly after Patchstack disclosure, so the practical risk for exposed sites is meaningful even without confirmed KEV status. The description labels the impact only as 'broken access control' without specifying integrity/availability effects, so the C:H / I:N / A:N split is plausible but unverified - operators handling sensitive directory data (member PII, private listings) should treat this as a priority patch, while sites publishing only public directory entries face lower realistic impact.

An unauthenticated attacker sends crafted HTTP requests to the WP Directory Kit plugin's AJAX or REST endpoints on a vulnerable site, bypassing the missing capability/nonce check to retrieve directory records or settings that should be protected. With CVSS AV:N/AC:L and no user interaction required, this is trivially scriptable across the public Internet against any WordPress site running the plugin at version ≤ 1.5.0.