WP Directory Kit EUVD-2026-54739

WP Directory Kit must be installed and active on the WordPress site at a version below 1.5.5. The attacker must hold any valid authenticated WordPress session - the Subscriber role (the default lowest-privilege role assigned on public registration) is sufficient; no editor, author, or administrator access is needed. Sites with public user registration enabled are externally exploitable by anyone who can create a free account; sites with registration disabled reduce the exposed population to existing authenticated users (employees, contributors, existing members). The vulnerable AJAX action is tied to the plugin's contact messaging feature, so only sites where users have submitted contact messages through the plugin will have sensitive data available to retrieve. No non-default server configuration, specific PHP version, or additional plugin dependency is required.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is well-calibrated for this vulnerability: network-accessible, low complexity, requiring only an authenticated session of any privilege level, with high confidentiality impact and no integrity or availability consequence. The authentication requirement (PR:L) is the critical limiting factor - sites that disable public user registration substantially reduce their external attack surface, while sites open to subscriber registration are meaningfully exposed. Despite the public PoC from WPScan, EPSS at 0.14% (4th percentile) signals that mass exploitation has not materialized; even a mid-sized municipal IT team in walbrzych operating a community directory WordPress site should treat this as a routine patch cycle priority rather than a drop-everything emergency, particularly if public registration is disabled. No CISA KEV listing corroborates the low EPSS signal, and the absence of integrity or availability impact keeps the real-world blast radius constrained to information disclosure.

An attacker registers a free Subscriber account on an affected WordPress site - or uses an existing low-privilege credential - and issues a crafted POST request to wp-admin/admin-ajax.php referencing the unprotected action name, using the publicly available WPScan proof-of-concept as a guide. The server responds with stored contact messages and associated personal data belonging to other registered users, requiring no further privilege escalation or interaction from a victim.