CVE-2026-16590 WP Directory Kit CVE debrief

Who should care

Administrators and users of the WP Directory Kit WordPress plugin should be aware of this vulnerability and take necessary actions to protect their systems. Additionally, security teams and IT professionals responsible for maintaining WordPress installations should prioritize patching and monitoring. Affected operator and platform teams should review and verify exposure, and vulnerability-management and security-team should track exceptions and retest remediated assets.

Technical summary

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions. This allows any authenticated user, such as a Subscriber, to retrieve stored contact messages and associated user data belonging to other users. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. Affected product deployments should be identified and verified for exposure. Security teams should review plugin usage and user activity for potential abuse and implement additional security measures.

Defensive priority

Medium-priority defensive actions are recommended due to the MEDIUM CVSS score of 6.5.

Recommended defensive actions

• Verify the WP Directory Kit plugin version and update to 1.5.5 or later if necessary.
• Restrict access to sensitive data and functionality within the plugin.
• Monitor plugin usage and user activity for potential abuse.
• Implement additional security measures such as Web Application Firewall (WAF) rules to detect and prevent exploitation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence from NVD and WPScan suggests that the WP Directory Kit WordPress plugin has a vulnerability allowing unauthorized access to contact messages and user data. Further verification is needed to determine the full scope of affected systems. Affected deployments should be identified and verified for exposure. Security teams should review plugin usage and user activity for potential abuse and implement additional security measures such as Web Application Firewall (WAF) rules to detect and prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.