Description

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-15T06:16:57.953Z",
  "pubdate": "2026-09-15T06:16:57.953Z",
  "executiveSummary": "The WP Directory Kit WordPress plugin, specifically in versions up to 1.5.7, is susceptible to an unauthorized data disclosure vulnerability due to insufficient access control checks. The vulnerability is classified as a Broken Access Control issue (CWE-285).\nAn unauthenticated attacker can exploit this flaw to retrieve sensitive information contained within draft or unapproved directory listings that are not intended for public view. By interacting with public AJAX actions that fail to validate the ownership or publication status of requested resources, an attacker can bypass standard visibility restrictions.\nThe impact of this vulnerability is significant, as it leads to the exposure of proprietary, private, or draft content, potentially leaking sensitive user data, business strategies, or pre-publication information. The vulnerability requires no authentication, allowing any remote attacker with network access to the target WordPress site to perform the exploit. Remediation necessitates the implementation of rigorous capability and ownership checks within the AJAX handler functions to ensure that only authorized users or public-facing content are accessible.",
  "technicalDetails": "The vulnerability resides within the internal API implementation of the WP Directory Kit plugin, which utilizes WordPress AJAX actions to handle dynamic content retrieval. The core issue is an improper authorization check occurring within the data-fetching routines responsible for returning listing content.\nSpecifically, the plugin's AJAX endpoints responsible for displaying listing details fail to verify the 'post_status' attribute of the requested listing object. In WordPress, listings or posts in a 'draft' or 'pending' state should only be visible to users with appropriate capabilities (e.g., 'edit_posts' or 'administrator' roles). The affected code path neglects to perform an ownership validation or status verification before executing a query to the database or returning the serialized data structure to the client.\nThe attack flow begins with the unauthenticated user identifying the AJAX action name used by WP Directory Kit. The attacker sends a crafted POST request to the standard WordPress 'admin-ajax.php' endpoint. By supplying a listing ID (typically an integer accessible through incremental enumeration or predictable URL patterns) as a parameter in the request, the attacker triggers the backend function. Because the function lacks an internal conditional check (such as 'is_user_logged_in()' or a call to 'current_user_can()' verified against the post object ownership), the backend service retrieves the raw content of the listing from the 'wp_posts' table regardless of the post status.\nThe application then proceeds to render or return the requested listing metadata and content, effectively broadcasting sensitive 'draft' or 'unapproved' listings to an unauthorized third party. This flaw essentially bypasses the WordPress privacy model, rendering the site's 'private' content publicly reachable through the AJAX interface.\nThe scope of the affected components includes all versions of the WP Directory Kit plugin up to and including version 1.5.7. Because the vulnerability exists within the public AJAX architecture, the attack surface is exposed via the network to any user capable of reaching the web server, requiring no prior administrative or subscriber privileges. Post-exploitation impact includes the systematic extraction of confidential business data, potential exposure of personally identifiable information (PII) if present in draft listings, and the total subversion of the plugin's content access control mechanisms."
}