CVE-2026-16594
WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
| Vendor | unknown |
| Product | wp directory kit |
| Published | Aug 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp directory kit
Be the first to know when new unknown vulnerabilities affecting unknown wp directory kit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Directory Kit
0 < 1.5.5
References
Credits
Yaswanth Reddy Sunkara WPScan