CVE-2025-13920
Sensitive Information Exposure in WP Directory Kit via AJAX Handler
Publication date: 2026-01-24
Last updated on: 2026-01-24
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | wp_directory_kit | to 1.4.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the WP Directory Kit WordPress plugin (up to version 1.4.9) allows unauthenticated attackers to extract email addresses of users who have Directory Kit-specific roles by exploiting the wdk_public_action AJAX handler. The issue was that user email addresses were appended to AJAX responses accessible without proper authorization, leading to sensitive information exposure. The vulnerability was fixed in version 1.5.0 by removing the code that appended email addresses to frontend AJAX responses. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of user email addresses, which may result in privacy violations, increased risk of phishing attacks, spam, and other malicious activities targeting exposed users. Since attackers do not need to be authenticated, the risk of information leakage is higher, potentially compromising user trust and security. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your WordPress installation is running the WP Directory Kit plugin version 1.4.9 or earlier. Additionally, monitoring AJAX requests to the 'wdk_public_action' handler for responses containing user email addresses can indicate exploitation attempts. For example, you can use curl or wget commands to send requests to the AJAX endpoint and inspect the output for exposed emails. Example command: curl -X POST https://yourwordpresssite.com/wp-admin/admin-ajax.php?action=wdk_public_action -d 'parameters' and check if email addresses are returned. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the WP Directory Kit plugin to version 1.5.0 or later, which contains the security fix that disables the exposure of user email addresses via the AJAX handler. Ensure your PHP version is 7.4 or later as required by the update. Additionally, verify that your site properly restricts access to AJAX endpoints and user capabilities to prevent unauthorized data exposure. [1]