CVE-2026-18232

WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.

Affected

WP Directory Kit

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.21% chance of exploitation in the next 30 days, 10th percentile

Published

2026-09-15

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/69d10ee3-0d36-47d1-b5bf-88b8516d99f4/

References

• CVE Record
• NVD entry