Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-16590: WP Directory Kit Plugin Exposes User Data
CVE-2026-16590 · published 2 months ago
Summary
The WP Directory Kit plugin for WordPress has a security flaw that allows any registered user to view contact messages and personal information of other users. This is a concern because sensitive user data is being exposed. To fix this, update the plugin to version 1.5.5 or later.
What to do
- Update unknown wp directory kit to version 1.5.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | wp directory kit | < 1.5.5 |
Original advisory text
WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-200Information Exposure
Timeline
Published8 Aug 2026
Updated4 Nov 2026
First seen8 Aug 2026
Track software like this
Free during beta