Description

The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plugin before 1.5.7's own roles.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-19T06:17:37.450Z",
  "pubdate": "2026-08-19T06:17:37.450Z",
  "executiveSummary": "An unauthenticated information disclosure vulnerability exists in the WP Directory Kit WordPress plugin prior to version 1.5.7. The vulnerability stems from a missing authorization check on a public AJAX action, which improperly exposes sensitive database records to unauthorized entities. Attackers leveraging this flaw can remotely retrieve user data, specifically targeting usernames and email addresses associated with specific plugin roles, without requiring authentication or prior privileges. This exposes user PII, facilitates targeted credential harvesting, and increases the attack surface for subsequent compromise vectors across affected WordPress deployments.",
  "technicalDetails": "The vulnerability resides within the AJAX action handling mechanism of the WP Directory Kit WordPress plugin prior to version 1.5.7. Specifically, the vulnerable component fails to implement adequate access control mechanisms, omitting proper authorization checks (such as capability verification or nonce validation) on a public-facing AJAX endpoint.\nThe root cause of the issue is the lack of session validation and permission verification before executing database queries tied to the public AJAX action. Upon receiving a crafted HTTP request targeting this endpoint, the application executes queries that retrieve database rows containing user information and returns the unmitigated dataset directly in the AJAX response.\nThe attack flow proceeds as follows: First, an unauthenticated remote attacker identifies the exposed public AJAX action endpoint provided by the WP Directory Kit plugin. Second, the attacker formulates an HTTP request invoking this specific AJAX action without supplying any authentication tokens, session cookies, or elevated privileges. Third, the plugin processes the request and queries the database, bypassing any authorization logic. Finally, the application returns the unfiltered database records containing sensitive information—specifically the usernames and email addresses of users assigned to the plugin's proprietary roles—directly to the attacker.\nThe attack requires network access to the target WordPress installation and relies solely on the default exposure of WordPress AJAX handlers (admin-ajax.php or REST endpoints). No prior privileges or user interaction are required to successfully execute the retrieval of sensitive user data, making the attack fully automatable and persistent until remediation is applied."
}