CVE-2026-16595: 
WordPress vulnerability analysis and mitigation

CVE-2026-16595 is an authorization bypass vulnerability in the WP Directory Kit WordPress plugin that allows any authenticated user (Subscriber-level or higher) to disclose the site's user list and unpublished listings belonging to other users. It affects all versions of the plugin before 1.5.5 and was publicly disclosed on August 3, 2026, with a patch released on August 8, 2026. The vulnerability carries a CVSS score of 4.3 (Medium) and is classified under CWE-200 (Information Exposure) (WPScan, Github Advisory).

The root cause is a missing authorization and nonce verification check on one of the plugin's authenticated AJAX action handlers (CWE-200: Information Exposure). Because the AJAX endpoint does not validate the requesting user's role or verify a nonce token, any logged-in user — including those with the lowest default WordPress role (Subscriber) — can invoke the action and retrieve sensitive data. The vulnerability is classified as OWASP Top 10 A3: Sensitive Data Exposure, and a proof-of-concept is scheduled for public release on August 17, 2026, to allow time for users to update (WPScan).

Successful exploitation allows any authenticated user to enumerate the complete WordPress site user list and view unpublished listings created by other users, exposing potentially sensitive personal and business data. This information could facilitate further attacks such as targeted phishing, credential stuffing against known usernames, or competitive intelligence gathering via access to draft/private content. The impact is limited to confidentiality — there is no evidence of integrity or availability impact (WPScan, Github Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. WPScan has indicated that a PoC will be published on August 17, 2026. The EPSS score is approximately 0.00139 (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only a valid WordPress account at Subscriber level or above, lowering the barrier for any registered site user (WPScan, Github Advisory).

1. Obtain authentication: Register or obtain credentials for any WordPress account on the target site (Subscriber role or higher is sufficient).
2. Identify the vulnerable AJAX endpoint: Locate the WP Directory Kit plugin's AJAX action by reviewing plugin source code or intercepting authenticated requests with a proxy tool such as Burp Suite.
3. Craft the AJAX request: Send an authenticated HTTP POST request to wp-admin/admin-ajax.php with the appropriate action parameter corresponding to the vulnerable AJAX handler, without needing a valid nonce.
4. Retrieve sensitive data: Parse the server's response to extract the full site user list and unpublished listings belonging to other users.
5. Leverage disclosed data: Use the enumerated usernames for further attacks (e.g., brute force, phishing) or exploit access to unpublished content for competitive or malicious purposes (WPScan).

• Network: Repeated authenticated POST requests to wp-admin/admin-ajax.php from low-privileged user accounts, particularly with action parameters associated with WP Directory Kit listing or user functions.
• Logs: WordPress access logs showing Subscriber-level accounts making frequent AJAX requests outside normal usage patterns; responses returning large JSON payloads containing user or listing data.
• Logs: Authentication events followed immediately by AJAX calls to directory kit endpoints from newly registered or rarely active accounts.

The primary remediation is to upgrade the WP Directory Kit plugin to version 1.5.5 or later, which introduces proper authorization and nonce verification on the affected AJAX action (WPScan, Github Advisory). As a temporary workaround prior to patching, administrators can disable the plugin or restrict site registration to prevent untrusted users from obtaining Subscriber accounts. Additionally, a Web Application Firewall (WAF) rule blocking unauthenticated or low-privileged access to the specific AJAX action can reduce exposure.