Unauthorized Data Exposure in WP Directory Kit Plugin for WordPress
CVE-2026-118418
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-118418?
The WP Directory Kit WordPress plugin before version 1.6.3 suffers from a significant oversight, allowing unauthenticated users to exploit its public directory-search action. This vulnerability permits attackers to access confidential user information, such as email addresses, login credentials, and private submissions from contact forms, without proper authorization checks. As a result, sensitive data of users can be exposed, highlighting the importance of implementing strict access controls in web applications.
Affected Version(s)
WP Directory Kit 0 < 1.6.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.