CVE-2026-16590

WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.

Affected

WP Directory Kit

CVSS v3.1 CNA

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.37% chance of exploitation in the next 30 days, 30th percentile

Published

2026-08-08

Updated

2026-08-10

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/ddf13b08-4ee2-46a1-929c-1f435e9e49d4/

References

• CVE Record
• NVD entry