CVE-2026-16594: WP Directory Kit Information Disclosure

CVE-2026-16594 Overview

CVE-2026-16594 affects the WP Directory Kit WordPress plugin in versions prior to 1.5.5. The plugin exposes an authenticated AJAX action that lacks both authorization checks and nonce validation. Any authenticated user, including low-privileged Subscriber accounts, can invoke the action to retrieve plugin settings. The exposed data includes sensitive API keys and secrets stored in the plugin configuration. This weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated attackers with minimal privileges can extract API keys and secrets from WP Directory Kit settings, enabling downstream compromise of integrated third-party services.

Affected Products

WP Directory Kit WordPress plugin versions prior to 1.5.5
WordPress sites running the affected plugin with any authenticated user role
Third-party services whose API keys and secrets are stored in the plugin configuration

Discovery Timeline

2026-08-08 - CVE-2026-16594 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-16594

Vulnerability Analysis

The vulnerability resides in an authenticated AJAX handler registered by the WP Directory Kit plugin. The handler is exposed through the standard WordPress wp-admin/admin-ajax.php endpoint using the wp_ajax_ action hook. WordPress registers hooks with the wp_ajax_ prefix as available to any authenticated user, regardless of role.

The handler returns the plugin's stored settings in the JSON response. These settings include sensitive credentials such as third-party API keys and integration secrets. An attacker with a Subscriber account, the lowest standard WordPress role, can invoke the endpoint and read the response.

See the WPScan Vulnerability Detail for further technical context.

Root Cause

The vulnerable AJAX action fails two required security controls. First, the handler does not perform a capability check using current_user_can() to verify the caller has administrative rights. Second, the handler does not validate a nonce using check_ajax_referer() or wp_verify_nonce(). Missing both controls allows any logged-in user to invoke the handler directly.

Attack Vector

An attacker registers or compromises a low-privilege WordPress account on the target site. The attacker then sends a POST request to admin-ajax.php specifying the vulnerable action name. The server responds with a JSON object containing the plugin's stored settings, including any configured API keys and secrets.

The attack requires no user interaction and no elevated privileges beyond a Subscriber-level session cookie. Refer to the WPScan advisory for endpoint specifics.

Detection Methods for CVE-2026-16594

Indicators of Compromise

Requests to wp-admin/admin-ajax.php from Subscriber-level accounts referencing WP Directory Kit action names
Anomalous JSON responses from admin-ajax.php containing key material such as api_key, secret, or token fields
Unexpected use of third-party API keys previously stored in WP Directory Kit settings originating from unfamiliar IP addresses

Detection Strategies

Correlate WordPress access logs for POST requests to admin-ajax.php by low-privilege accounts and flag those with WP Directory Kit action parameters.
Alert on newly registered Subscriber accounts that immediately issue authenticated AJAX requests, a pattern consistent with automated exploitation.
Monitor third-party service audit logs for API key usage from geolocations or user agents inconsistent with the WordPress host.

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and forward the logs to a centralized analytics platform for retention and query.
Track outbound API activity from integrated services (payment providers, mail relays, CRMs) for reuse of exposed credentials.
Review WordPress user creation events for unauthorized Subscriber registrations, particularly on sites with open registration enabled.

How to Mitigate CVE-2026-16594

Immediate Actions Required

Update WP Directory Kit to version 1.5.5 or later on all affected WordPress installations.
Rotate every API key, secret, and token stored in the plugin's settings, treating the values as compromised.
Audit WordPress user accounts and remove unfamiliar Subscriber or higher-role accounts created before the patch.

Patch Information

The vendor addressed CVE-2026-16594 in WP Directory Kit version 1.5.5. The fix adds authorization and nonce validation to the affected AJAX handler. Administrators should apply the update through the WordPress plugin manager or by replacing plugin files manually. Confirmation of the patched version is available in the WPScan Vulnerability Detail.

Workarounds

Disable the WP Directory Kit plugin until the update to 1.5.5 can be applied.
Disable open user registration by unchecking "Anyone can register" under WordPress General Settings to reduce the pool of Subscriber accounts.
Restrict access to wp-admin/admin-ajax.php at the web application firewall (WAF) layer to block requests carrying the vulnerable action name.

bash

# Example WAF rule to block the vulnerable AJAX action (adjust action name per WPScan advisory)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,id:1026165940,phase:2,deny,status:403,msg:'Block WP Directory Kit vulnerable AJAX action'"
  SecRule ARGS:action "@rx ^wpdk_.*settings.*$" "t:lowercase"