Authentication Bypass in WP Directory Kit Plugin

Executive Summary

This vulnerability affects the WP Directory Kit WordPress plugin versions before 1.5.5. It allows any authenticated user, including those with a Subscriber role, to access and disclose sensitive plugin settings and API keys due to missing authorization and nonce checks on an authenticated AJAX action.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the WP Directory Kit plugin. If it is below 1.5.5, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin files directly.

Useful 0 Not Useful 0

Impact Analysis

An attacker with even minimal access (like a Subscriber role) could steal sensitive API keys and secrets from the plugin settings. This could lead to unauthorized access to external services, data breaches, or further exploitation of the WordPress site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, which may violate GDPR (if personal data is exposed) or HIPAA (if protected health information is compromised). Non-compliance could result in legal penalties or fines.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP Directory Kit plugin to version 1.5.5 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied to prevent unauthorized access to sensitive data.

Useful 0 Not Useful 0