CVE-2026-16592 — WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes

CVE-2026-16592

WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes PUBLISHED

Description (CNA)

The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Directory Kit	affected 0 through 1.5.7

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/aed24421-3bc6-4b36-bb61-d842d40d7c3c/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.