Information disclosure in Wp Directory Kit
CVE-2026-18231
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plugin before 1.5.7's own roles.
Vulnerability class: Information Disclosure
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Unknown Wp Directory Kit
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-18231?
- CVE-2026-18231 is a medium-severity vulnerability in Wp Directory Kit, classified under Information Disclosure. CVSS score: 5.3/10. Published 2026-08-19.
- How severe is CVE-2026-18231?
- Medium severity. CVSS v3 base score is 5.3 out of 10.