CVE-2026-16594 WP Directory Kit CVE debrief

Who should care

Users of the WP Directory Kit WordPress plugin, especially those with sensitive API keys and secrets, should update to version 1.5.5 or later and restrict access to sensitive settings. Affected operators and platforms should review vulnerability management and security team impact. Security teams should prioritize patching and verify configuration to prevent exploitation.

Technical summary

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user to disclose sensitive settings, including API keys and secrets. This vulnerability affects users of the WP Directory Kit WordPress plugin, especially those with sensitive API keys and secrets. The vulnerability has a CVSS score of 7.5 and a severity of HIGH.

Defensive priority

Authenticated users may be able to disclose sensitive settings, including API keys and secrets.

Recommended defensive actions

• Verify WP Directory Kit plugin version and update to 1.5.5 or later
• Restrict access to sensitive settings and API keys
• Monitor for suspicious activity related to authenticated AJAX actions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is based on a single source reference from WPScan, which reported the vulnerability. Limited information is available about the vulnerability's scope and impact. The CVE record was published on 2026-08-08T07:17:10.910Z and has not been modified since then. The NVD entry is currently Deferred. Defenders should verify WP Directory Kit plugin version and configuration, review sensitive settings and API keys, and monitor for suspicious activity related to authenticated AJAX actions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.