CVE-2026-18231: WP Directory Kit Information Disclosure

CVE-2026-18231 Overview

CVE-2026-18231 is an information disclosure vulnerability in the WP Directory Kit WordPress plugin before version 1.5.7. The plugin exposes a public AJAX action without any authorization check. The endpoint returns unfiltered database rows to any caller. Unauthenticated attackers can retrieve usernames and email addresses of users assigned to roles created by the plugin. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can enumerate usernames and email addresses of WP Directory Kit users, enabling targeted phishing and credential stuffing campaigns against affected WordPress sites.

Affected Products

WP Directory Kit WordPress plugin versions prior to 1.5.7
WordPress sites using WP Directory Kit with plugin-managed user roles
Any WordPress deployment exposing the vulnerable public AJAX action

Discovery Timeline

2026-08-19 - CVE-2026-18231 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-18231

Vulnerability Analysis

The WP Directory Kit plugin registers a public AJAX action handler in WordPress that is reachable through the standard admin-ajax.php endpoint. WordPress exposes AJAX actions registered under the wp_ajax_nopriv_ hook to unauthenticated visitors by design. The plugin's handler queries the WordPress users table for accounts holding roles defined by the plugin. It then returns the raw database rows in the response.

The handler performs no capability check, no nonce validation, and no filtering of returned columns. Attackers can invoke the endpoint directly with a simple HTTP request. The response discloses usernames and email addresses that WordPress otherwise restricts to administrators.

This exposure enables user enumeration at scale. Attackers can harvest email addresses for phishing operations. They can also feed usernames into credential stuffing tools against the WordPress login endpoint.

Root Cause

The root cause is a missing authorization check on a public AJAX action combined with unfiltered output of database records. The plugin developer registered the AJAX handler as publicly accessible without validating the caller's identity or capabilities. The handler also returned complete user rows rather than a filtered projection containing only non-sensitive fields.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted POST or GET request to the target site's admin-ajax.php endpoint specifying the vulnerable plugin action. The server processes the request and returns the user data in the HTTP response body. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-18231

Indicators of Compromise

Repeated unauthenticated POST or GET requests to /wp-admin/admin-ajax.php referencing WP Directory Kit action names
HTTP responses from admin-ajax.php containing JSON payloads with user_login and user_email fields returned to unauthenticated clients
Anomalous request volume to admin-ajax.php from a single source IP or small IP range
Subsequent phishing emails targeting addresses tied to WP Directory Kit user roles

Detection Strategies

Inspect web server access logs for high-frequency requests to admin-ajax.php with the WP Directory Kit action parameter and no authenticated session cookie
Deploy WAF rules that flag or block anonymous access to plugin-specific AJAX actions on WordPress sites
Correlate outbound response sizes from admin-ajax.php against expected baselines to detect bulk data exfiltration

Monitoring Recommendations

Enable verbose logging on WordPress and forward access logs to a centralized analytics platform for anomaly detection
Track unique source IPs hitting admin-ajax.php and alert on sources exceeding request thresholds within short time windows
Monitor for follow-on authentication failures against wp-login.php that may indicate credential stuffing using harvested usernames

How to Mitigate CVE-2026-18231

Immediate Actions Required

Update the WP Directory Kit plugin to version 1.5.7 or later on all WordPress installations
Audit user accounts assigned to WP Directory Kit roles and notify affected users of potential email exposure
Deploy WAF rules to block anonymous requests to the vulnerable AJAX action until patching is complete

Patch Information

The vendor addressed CVE-2026-18231 in WP Directory Kit version 1.5.7. The fix introduces an authorization check on the affected AJAX action and restricts returned data to non-sensitive fields. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the WP Directory Kit plugin until the patched version can be installed
Restrict access to admin-ajax.php at the reverse proxy or WAF layer to authenticated sessions where feasible
Apply rate limiting to admin-ajax.php requests to reduce the effectiveness of bulk enumeration

bash

# Example nginx rate limit for admin-ajax.php
limit_req_zone $binary_remote_addr zone=ajax_limit:10m rate=10r/m;

location = /wp-admin/admin-ajax.php {
    limit_req zone=ajax_limit burst=5 nodelay;
    include fastcgi_params;
    fastcgi_pass php_upstream;
}