CVE-2026-16592: WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes
Published Sep 15, 2026
·Updated
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
Affected Software
1 affected component
WordPress plugin "WP Directory Kit"<=1.5.7
Event History
Sep 15, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A user with a WordPress role as low as Contributor can exploit the affected shortcode. The disclosed listing content can belong to other users.
2
What information may be exposed?
Non-public listing content may be disclosed, including password-protected listing content and hidden fields.
3
Are public-only listings the only concern?
No. The affected shortcode does not check listing visibility, so non-public listings are within scope.