Executive Summary

This vulnerability in the WP Directory Kit WordPress plugin (up to version 1.4.9) allows unauthenticated attackers to extract email addresses of users who have Directory Kit-specific roles by exploiting the wdk_public_action AJAX handler. The issue was that user email addresses were appended to AJAX responses accessible without proper authorization, leading to sensitive information exposure. The vulnerability was fixed in version 1.5.0 by removing the code that appended email addresses to frontend AJAX responses. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of user email addresses, which may result in privacy violations, increased risk of phishing attacks, spam, and other malicious activities targeting exposed users. Since attackers do not need to be authenticated, the risk of information leakage is higher, potentially compromising user trust and security. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if your WordPress installation is running the WP Directory Kit plugin version 1.4.9 or earlier. Additionally, monitoring AJAX requests to the 'wdk_public_action' handler for responses containing user email addresses can indicate exploitation attempts. For example, you can use curl or wget commands to send requests to the AJAX endpoint and inspect the output for exposed emails. Example command: curl -X POST https://yourwordpresssite.com/wp-admin/admin-ajax.php?action=wdk_public_action -d 'parameters' and check if email addresses are returned. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the WP Directory Kit plugin to version 1.5.0 or later, which contains the security fix that disables the exposure of user email addresses via the AJAX handler. Ensure your PHP version is 7.4 or later as required by the update. Additionally, verify that your site properly restricts access to AJAX endpoints and user capabilities to prevent unauthorized data exposure. [1]

Useful 0 Not Useful 0