EUVD-2026-54741
GHSA-42rf-5p25-qxgw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible AJAX endpoint, subscriber-level auth required, pure read-only disclosure with no integrity or availability impact and no scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the site's user list and unpublished listings belonging to other users.
AnalysisAI
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to missing authorization and nonce validation on an AJAX endpoint. Any subscriber-level account holder can trigger the vulnerable action to enumerate the full WordPress user list and access unpublished directory listings belonging to other users - data that should be restricted to privileged roles. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account of any role, including the lowest-privilege Subscriber role - meaning the attacker must be a registered user on the target site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the technical severity: network-accessible, low complexity, low privilege required, with high confidentiality impact limited to the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or already holds a subscriber-level account on a target WordPress site running WP Directory Kit before 1.5.5. Using the publicly available POC (referenced in the WPScan advisory), the attacker sends a crafted authenticated AJAX request to the vulnerable action endpoint without any elevated credentials, receiving in return the site's full registered user list and any unpublished directory listings - enabling targeted phishing against identified users or competitive intelligence on draft listings. |
| Remediation | Update WP Directory Kit to version 1.5.5 or later, which is confirmed as the vendor-released patched version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Directory Kit
View allThe WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' pa
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers t
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticate
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with mat
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a m
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today