CVE-2026-18232: WP Directory Kit Information Disclosure Flaw

CVE-2026-18232 Overview

CVE-2026-18232 is an information disclosure vulnerability in the WP Directory Kit WordPress plugin through version 1.5.7. The plugin exposes a public AJAX action that returns listing content without verifying the listing's status or ownership. Unauthenticated attackers can invoke this action to read draft and unapproved listings belonging to other users. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote, unauthenticated attackers can retrieve private draft and unapproved directory listings, exposing content that site owners intended to keep confidential prior to publication or approval.

Affected Products

WP Directory Kit WordPress plugin, versions up to and including 1.5.7
WordPress sites with the vulnerable plugin activated
Directory-style websites relying on WP Directory Kit for listing moderation

Discovery Timeline

2026-09-15 - CVE-2026-18232 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-18232

Vulnerability Analysis

The WP Directory Kit plugin registers a public AJAX action that returns the content of a listing when supplied with a listing identifier. The handler retrieves the listing record and serializes it back to the caller without validating whether the requesting user is the listing owner. It also skips checking whether the listing is in a published or approved state. As a result, requests referencing draft or pending listings receive the same response as requests for published entries.

Because the endpoint is reachable through wp-admin/admin-ajax.php with no authentication, any remote attacker can iterate listing IDs to enumerate confidential content. Impacted data can include unpublished business details, contact information, pricing, and moderation-only fields that site owners never intended to expose.

Root Cause

The root cause is missing authorization and status checks in the AJAX handler that returns listing content. The plugin trusts the client-supplied listing ID and performs no server-side verification of ownership or publication state before returning the record.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends crafted POST or GET requests to the vulnerable AJAX action while enumerating listing IDs. No credentials, user interaction, or elevated privileges are required. See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-18232

Indicators of Compromise

High-volume requests to wp-admin/admin-ajax.php from a single IP referencing the WP Directory Kit listing action
Sequential enumeration of the listing ID parameter within a short time window
Unauthenticated requests returning listing payloads with draft or pending status fields

Detection Strategies

Inspect web server access logs for repeated admin-ajax.php calls with the WP Directory Kit action name and varying listing identifiers.
Correlate response sizes and status codes to identify unauthenticated clients consistently receiving listing content.
Deploy WordPress-aware WAF rules that flag AJAX requests to directory plugin actions originating from unauthenticated sessions.

Monitoring Recommendations

Track WP Directory Kit AJAX endpoint request rates and alert on deviations from baseline traffic patterns.
Monitor outbound response payload sizes on admin-ajax.php for anomalies suggesting bulk data retrieval.
Enable and retain PHP application logs to preserve evidence of enumeration attempts for incident response.

How to Mitigate CVE-2026-18232

Immediate Actions Required

Update the WP Directory Kit plugin to a version later than 1.5.7 as soon as a patched release is available from the vendor.
Audit existing draft and unapproved listings to identify content that may have been exposed prior to patching.
Restrict access to wp-admin/admin-ajax.php from untrusted networks where feasible using WAF or reverse-proxy rules.

Patch Information

At the time of publication, refer to the WPScan Vulnerability Report for the latest fixed-version guidance. Site administrators should apply vendor updates through the WordPress plugin management interface and verify the installed version is greater than 1.5.7.

Workarounds

Deactivate the WP Directory Kit plugin until a patched version is installed if draft confidentiality is critical.
Deploy a WAF rule blocking unauthenticated requests to the vulnerable WP Directory Kit AJAX action.
Limit the sensitivity of information stored in draft listings until the plugin is updated.

bash

# Example WAF rule to block unauthenticated access to the vulnerable action
# Replace <action_name> with the WP Directory Kit AJAX action identified in the advisory
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1002026,msg:'Block WP Directory Kit listing enumeration'"
  SecRule ARGS:action "@streq <action_name>" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in "@eq 0"