CVE-2026-16592
Received Received - Intake

Authorization Bypass in WP Directory Kit WordPress Plugin

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: WPScan

Description
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-16592
EUVD
EUVD-2026-78281

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_directory_kit wp_directory_kit to 1.5.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WP Directory Kit WordPress plugin versions 1.5.7 and below. It allows users with a Contributor role or higher to access non-public listing content, including password-protected and hidden fields, belonging to other users through a shortcode that lacks proper authorization checks.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the WP Directory Kit plugin version 1.5.7 or below. Inspect shortcode usage for unauthorized data exposure. Review user roles for Contributors or higher accessing non-public content.

Impact Analysis

If you use this plugin, attackers with minimal access (Contributor role) could view sensitive data such as private listings or protected content from other users. This could lead to unauthorized data exposure or privacy breaches.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing sensitive user data without authorization. Organizations may face legal penalties or reputational damage due to unauthorized data disclosure.

Mitigation Strategies

Immediately update the WP Directory Kit plugin to the latest version if available. If no update exists, consider disabling the plugin until a patch is released. Restrict Contributor roles to minimize exposure. Monitor for unusual data access patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16592. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart