CVE-2026-16590: WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure
Published Aug 8, 2026
·Updated
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.
Affected Software
1 affected component
WP Directory Kit WordPress plugin<1.5.5
Event History
Aug 8, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2026-16590?
The severity of CVE-2026-16590 is classified as a risk of 48.
2
How do I fix CVE-2026-16590?
To fix CVE-2026-16590, update the WP Directory Kit plugin to version 1.5.5 or later.
3
What type of vulnerability is CVE-2026-16590?
CVE-2026-16590 is categorized as an information leak vulnerability.
4
Who is affected by CVE-2026-16590?
Any authenticated user, such as a Subscriber, can be affected by CVE-2026-16590.
5
What impact does CVE-2026-16590 have on user data?
CVE-2026-16590 allows unauthorized retrieval of stored contact messages and user data belonging to other users.