CVE-2026-16592: WP Directory Kit Information Disclosure

CVE-2026-16592 Overview

The WP Directory Kit WordPress plugin through version 1.5.7 contains a broken access control flaw in one of its shortcodes. The plugin fails to check authorization or listing visibility before rendering listing content. Authenticated users with a role as low as Contributor can disclose non-public listing data belonging to other users. Exposed data includes password-protected listings and hidden fields intended to remain private. The issue is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Low-privileged authenticated users can read password-protected and hidden listing fields owned by other WordPress users, breaking the plugin's confidentiality model.

Affected Products

WP Directory Kit WordPress plugin versions up to and including 1.5.7
WordPress installations that expose the vulnerable shortcode to Contributor-or-higher accounts
Sites relying on the plugin's password-protection or hidden-field features for confidentiality

Discovery Timeline

2026-09-15 - CVE-2026-16592 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-16592

Vulnerability Analysis

The vulnerability resides in a shortcode handler shipped with WP Directory Kit. The shortcode renders listing content without validating whether the current user is authorized to view the target listing. It also ignores listing visibility flags such as password protection and hidden field markers. As a result, a Contributor-level account can render arbitrary listings by supplying identifiers to the shortcode. The disclosed data may include private business details, contact information, and other fields the listing owner explicitly restricted. Because WordPress Contributor accounts are frequently granted to guest authors and community members, the trust boundary crossed here is meaningful.

Root Cause

The root cause is missing authorization enforcement in the shortcode rendering path. The plugin resolves the requested listing and returns its fields without consulting ownership metadata, visibility state, or password gates. This is a classic broken access control pattern where server-side checks are assumed but not implemented.

Attack Vector

Exploitation requires an authenticated session with at least Contributor privileges. The attacker creates or edits a post that embeds the vulnerable shortcode with parameters targeting a victim listing. Previewing or publishing the post triggers the shortcode, and the response contains the restricted listing content. The technique does not require user interaction from the victim and works over standard HTTP requests to the WordPress site.

See the WPScan vulnerability report for technical details.

Detection Methods for CVE-2026-16592

Indicators of Compromise

Post revisions or drafts authored by Contributor accounts containing WP Directory Kit shortcodes referencing listings the author does not own.
Access log entries showing Contributor sessions repeatedly requesting /wp-admin/post.php preview endpoints for posts containing the plugin's shortcode.
Unexpected rendering of password-protected listing fields in HTML responses returned to non-owner sessions.

Detection Strategies

Audit the wp_posts and wp_postmeta tables for shortcode usage patterns that reference listing IDs across multiple authors.
Correlate WordPress user role assignments with shortcode invocations to identify low-privilege accounts probing listing identifiers.
Review web server logs for enumeration patterns where a single authenticated session iterates through sequential listing IDs.

Monitoring Recommendations

Enable WordPress activity logging plugins to capture post creation, preview, and shortcode evaluation events tied to user roles.
Alert on new Contributor accounts that immediately author content containing directory or listing shortcodes.
Track outbound response sizes for preview endpoints to flag responses that exceed expected listing payloads.

How to Mitigate CVE-2026-16592

Immediate Actions Required

Update WP Directory Kit to a version later than 1.5.7 once the vendor publishes a patched release.
Review existing Contributor, Author, and Editor accounts and remove any that are not actively required.
Audit posts and drafts for unauthorized use of WP Directory Kit shortcodes and remove suspicious entries.

Patch Information

The advisory indicates the vulnerability is present through version 1.5.7. Administrators should monitor the WPScan advisory and the plugin's WordPress.org page for a fixed release and apply it as soon as it becomes available.

Workarounds

Temporarily deactivate the WP Directory Kit plugin until a patched version is available if password-protected or hidden listing data must remain confidential.
Restrict content authoring to trusted roles by removing shortcode execution rights from Contributor accounts using a capability management plugin.
Deploy a web application firewall rule that blocks the vulnerable shortcode when submitted by sessions below Editor role.

bash

# Example: disable the plugin via WP-CLI pending a vendor patch
wp plugin deactivate wp-directory-kit