CVE-2026-118418: WP Directory Kit < 1.6.3 - Unauthenticated User Data and Contact Message Disclosure
The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and private contact-form submissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Directory Kitto a version that resolves this vulnerability.Fixed in 1.6.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit the public directory-search action; no login or authorization is required.
What information may be exposed?
The vulnerable action may disclose other users' personal data, including email addresses and login names, as well as private contact-form submissions.
What versions are affected?
WP Directory Kit versions before 1.6.3 are affected. Updating to version 1.6.3 or later addresses the affected version range.
How can I determine whether my site may already have exposed data?
Review whether the site used WP Directory Kit before 1.6.3 and exposed its public directory-search functionality. The provided information does not include indicators or logs that can confirm prior exploitation.