WP Directory Kit Authenticated Data Exposure Vulnerability

Executive Summary

This vulnerability affects the WP Directory Kit WordPress plugin versions before 1.5.5. It allows any authenticated user, including those with a Subscriber role, to access stored contact messages and user data belonging to other users due to missing authorization and nonce checks on an authenticated AJAX action.

Useful 0 Not Useful 0

Detection Guidance

Check if your WordPress site uses WP Directory Kit plugin version prior to 1.5.5. Log in as a Subscriber and attempt to access the vulnerable AJAX endpoint to see if unauthorized data is retrievable. Review server logs for suspicious AJAX requests targeting the plugin.

Useful 0 Not Useful 0

Impact Analysis

An attacker with even minimal access (like a Subscriber role) could steal sensitive contact messages and user data from other users. This could lead to privacy breaches, data leaks, or misuse of personal information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by leaking protected health information if such data was stored in the plugin. Non-compliance may result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP Directory Kit plugin to version 1.5.5 or later immediately. If updating is not possible, consider temporarily disabling the plugin until an update is applied. Review user roles and permissions to ensure least privilege access.

Useful 0 Not Useful 0