CVE-2026-16590: WP Directory Kit Information Disclosure

CVE-2026-16590 Overview

CVE-2026-16590 is a broken access control vulnerability in the WP Directory Kit WordPress plugin before version 1.5.5. The plugin fails to perform authorization or nonce checks on one of its authenticated AJAX actions. Any authenticated user, including low-privilege Subscribers, can invoke the action to retrieve stored contact messages and associated user data belonging to other users. The flaw is categorized under [CWE-200] Information Exposure and affects confidentiality of directory records collected through the plugin.

Critical Impact
Authenticated Subscriber-level users can exfiltrate private contact messages and personal data of other WP Directory Kit users through an unprotected AJAX endpoint.

Affected Products

WP Directory Kit WordPress plugin versions prior to 1.5.5
WordPress sites exposing the plugin's authenticated AJAX action to any registered user role
Deployments allowing open user registration where Subscriber accounts can be created freely

Discovery Timeline

2026-08-08 - CVE-2026-16590 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-16590

Vulnerability Analysis

The vulnerability resides in an authenticated AJAX action registered by the WP Directory Kit plugin. WordPress AJAX handlers registered under the wp_ajax_{action} hook are accessible to any logged-in user regardless of role. Secure implementations must perform two additional checks: a capability check using current_user_can() and a nonce validation using check_ajax_referer(). The affected handler performs neither check before returning stored records.

As a result, the endpoint returns contact submissions and associated user data to any authenticated caller. An attacker holding a Subscriber account, the lowest default WordPress role, can enumerate stored records belonging to other users. This exposes private communications collected through the directory listing feature. The issue maps to [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Root Cause

The root cause is the absence of authorization and request-integrity controls on a privileged AJAX endpoint. The plugin conflates authentication with authorization, treating any logged-in session as sufficient to read arbitrary directory data. Missing nonce validation also removes protection against cross-site request forgery through authenticated victim sessions.

Attack Vector

Exploitation requires network access to the WordPress site and valid credentials for any user role. The attacker sends a crafted POST request to wp-admin/admin-ajax.php specifying the vulnerable action name. The plugin executes the handler and returns other users' contact messages and profile fields in the response body. No user interaction from the victim is required. See the WPScan Vulnerability Advisory for further technical detail.

Detection Methods for CVE-2026-16590

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php originating from Subscriber-level accounts
High volumes of AJAX responses containing multiple contact records returned to a single authenticated session
Newly registered Subscriber accounts issuing directory-related AJAX requests shortly after account creation

Detection Strategies

Review WordPress access logs for admin-ajax.php requests referencing WP Directory Kit action names issued by non-administrative users
Correlate authentication events with AJAX request patterns to identify low-privilege accounts accessing directory data
Enable WordPress debug logging or a security plugin to record AJAX action invocations along with user role context

Monitoring Recommendations

Monitor plugin version inventory across WordPress deployments and flag installations below 1.5.5
Alert on bulk data responses from admin-ajax.php exceeding baseline size for the affected endpoints
Track new user registrations and correlate with subsequent access to plugin AJAX handlers

How to Mitigate CVE-2026-16590

Immediate Actions Required

Update the WP Directory Kit plugin to version 1.5.5 or later on all WordPress instances
Audit existing Subscriber and low-privilege accounts and remove unrecognized or dormant users
Rotate any credentials or contact records considered sensitive if unauthorized access is suspected

Patch Information

The vendor addressed the issue in WP Directory Kit version 1.5.5 by adding authorization and nonce checks to the affected AJAX action. Administrators should apply the update through the WordPress plugin manager or by replacing the plugin files with the patched release. Refer to the WPScan Vulnerability Advisory for advisory details.

Workarounds

Disable the WP Directory Kit plugin until the patched version can be deployed
Restrict new user registration by setting the WordPress users_can_register option to 0 to limit attacker access
Deploy a web application firewall rule to block requests to the vulnerable AJAX action from non-administrative sessions

bash

# Configuration example: disable open registration in wp-config.php or via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber
wp plugin update wp-directory-kit --version=1.5.5