Description

The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-15T06:16:57.127Z",
  "pubdate": "2026-09-15T06:16:57.127Z",
  "executiveSummary": "The WP Directory Kit WordPress plugin, in versions up to 1.5.7, is affected by an authorization bypass vulnerability within its shortcode processing logic.\nThe vulnerability originates from a failure to validate user authorization and listing visibility settings, which allows unauthorized access to private, hidden, or password-protected directory content.\nThe flaw stems from insufficient access control checks, permitting users with minimal privileges—such as the Contributor role—to view sensitive information belonging to other users.\nThe impact includes unauthorized information disclosure, compromising the confidentiality of listing data. The risk level is significant, as it permits lateral access to data not intended for public view or for specific user roles.\nExploitation requires that an attacker holds a registered account with at least Contributor-level privileges, enabling them to leverage the plugin's shortcode output mechanism to bypass standard WordPress content restrictions.",
  "technicalDetails": "The vulnerability resides in the core processing logic of the WP Directory Kit shortcode implementation. The plugin fails to verify the current user's authorization levels or check the visibility status of the requested listing entities before rendering content.\nWhen a user invokes the vulnerable shortcode, the underlying function executes a query to fetch listing data without incorporating the necessary `WP_Query` parameters or post-meta visibility checks that WordPress typically uses to enforce content privacy.\nSpecifically, the plugin bypasses the `post_password_required()` check and ignores the `post_status` or custom visibility meta-tags assigned to specific directory entries.\nAn attacker with a Contributor account can supply specific parameters to the shortcode to retrieve the contents of private listings. Because the plugin logic processes these requests server-side without verifying if the requesting user has 'read_private_posts' or equivalent capabilities, the application returns sensitive data in the HTTP response.\nThe attack flow proceeds as follows: 1) The attacker authenticates as a user with at least Contributor privileges. 2) The attacker places the vulnerable shortcode—configured to target a specific, non-public listing ID—within a draft post or any area where shortcodes are parsed. 3) Upon processing, the plugin executes the data retrieval function, which fails to cross-reference the user ID or the access control list (ACL) of the listing object. 4) The plugin fetches the data from the database, including protected fields and hidden attributes. 5) The sensitive data is rendered in the output of the shortcode, allowing the attacker to view restricted content that should be accessible only to site administrators or the original author.\nThis deficiency effectively bypasses the native WordPress access control layer for all data handled by the plugin's shortcode engine. Since the rendering logic is detached from the standard content-filtering hooks, it circumvents visibility restrictions, leading to unauthorized data exfiltration within the application context."
}