EUVD-2026-78282
GHSA-m75w-g67x-v923
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Public AJAX action needs no authentication or interaction (AV:N/PR:N/UI:N) with trivial enumeration (AC:L), but only partial confidentiality impact (C:L).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.
AnalysisAI
WP Directory Kit, a WordPress directory/listing plugin, exposes the content of draft and unapproved listings to anyone who can reach its public AJAX actions. Versions through 1.5.7 omit status and ownership checks before returning listing content, so unauthenticated attackers can enumerate other users' unpublished submissions (CWE-200, information disclosure). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the WP Directory Kit plugin to be active on a WordPress site at version 1.5.7 or earlier and its public AJAX action to be reachable - which is the default deployment state for a plugin whose front-end serves listing content to anonymous visitors, so no non-default configuration is needed for the vulnerable handler itself. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 5.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N describes a network-reachable, low-complexity, unauthenticated read of limited confidentiality value - which matches the description exactly, and the low EPSS of 0.14% (4th percentile) confirms the community does not expect broad exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WP Directory Kit to a release later than 1.5.7 - the input data states affected versions are 'through 1.5.7' but does NOT specify the first patched version, so confirm the fixed build on the plugin's WordPress.org page or the WPScan advisory (https://wpscan.com/vulnerability/69d10ee3-0d36-47d1-b5bf-88b8516d99f4/) before declaring remediation complete; no patch version should be assumed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Directory Kit
View allThe WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'attribute_value' and 'attribute_id' pa
Unauthenticated SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows remote attackers t
SQL injection in WP Directory Kit WordPress plugin (all versions before 1.5.6) allows any authenticated user - including
The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1
The WP Directory Kit plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.1.9
SQL injection via an unsecured AJAX endpoint in WP Directory Kit (WordPress plugin) before 1.5.5 allows any authenticate
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with mat
SQL injection in the WP Directory Kit WordPress plugin (versions through 1.5.7) lets authenticated users with page-build
Unauthorized data exposure in the WP Directory Kit WordPress plugin (all versions before 1.5.5) allows any authenticated
WP Directory Kit WordPress plugin before version 1.5.5 exposes sensitive site data to any authenticated user due to miss
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a m
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today