Authorization Bypass Vulnerability in WP Directory Kit WordPress Plugin
CVE-2026-18231
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 19 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-18231?
A vulnerability exists in the WP Directory Kit WordPress plugin, prior to version 1.5.7, that lacks proper authorization checks on a public AJAX action. This flaw allows unauthorized attackers to query unfiltered database rows, potentially exposing sensitive user data such as usernames and email addresses associated with the plugin's roles. This vulnerability emphasizes the need for rigorous security measures in plugin development to protect user information against unauthorized access.
Affected Version(s)
WP Directory Kit 0 < 1.5.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.