CVE-2026-18231
WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WP Directory Kit WordPress plugin before 1.5.7 does not perform any authorization check on one of its public AJAX actions and returns unfiltered database rows, allowing unauthenticated attackers to retrieve the usernames and email addresses of users holding the WP Directory Kit WordPress plugin before 1.5.7's own roles.
| Vendor | unknown |
| Product | wp directory kit |
| Published | Aug 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp directory kit
Be the first to know when new unknown vulnerabilities affecting unknown wp directory kit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Directory Kit
0 < 1.5.7
References
Credits
Erwan LR (WPScan) WPScan