WP Directory Kit EUVD-2026-54741

Exploitation requires a valid WordPress account of any role, including the lowest-privilege Subscriber role - meaning the attacker must be a registered user on the target site. The CVSS vector PR:L confirms this low-privilege authenticated requirement. The vulnerable code path is an authenticated AJAX action, so unauthenticated exploitation is not possible. What limits exploitation in practice: (1) the attacker must have or obtain a valid WordPress login, which on sites with closed registration is a meaningful barrier; (2) the impact is read-only (no integrity or availability impact), limiting damage to information disclosure of users and unpublished listings; (3) sites where all subscriber accounts belong to trusted users face no realistic insider threat. The plugin must be installed and active - sites not running WP Directory Kit are entirely unaffected.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the technical severity: network-accessible, low complexity, low privilege required, with high confidentiality impact limited to the vulnerable system. However, real-world risk must be contextualized: EPSS at 0.14% (4th percentile) indicates very low observed exploitation probability across the internet, placing this well below average exploitation likelihood. A public POC exists (per WPScan) but CISA KEV confirmation is absent, meaning mass exploitation has not been confirmed. The C:H rating is meaningful - user enumeration can enable credential stuffing, targeted phishing, and reconnaissance of unpublished business-sensitive directory listings. The primary real-world risk applies to multi-tenant or membership-based WordPress deployments where subscriber accounts are granted to external or untrusted users. Sites with no subscriber-level external users face negligible actual risk. This is a moderate-priority issue requiring patching but not emergency response absent evidence of active targeting.

An attacker registers or already holds a subscriber-level account on a target WordPress site running WP Directory Kit before 1.5.5. Using the publicly available POC (referenced in the WPScan advisory), the attacker sends a crafted authenticated AJAX request to the vulnerable action endpoint without any elevated credentials, receiving in return the site's full registered user list and any unpublished directory listings - enabling targeted phishing against identified users or competitive intelligence on draft listings.