CVE-2026-16594— WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WP Directory Kit | < 1.5.5 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16594
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress WP Directory Kit 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress WP Directory Kit是WordPress基金会开源的一款目录管理插件。 WordPress WP Directory Kit 1.5.5之前版本存在安全漏洞，该漏洞源于对某个已认证的AJAX操作未执行授权或nonce检查，可能导致任意已认证用户（如订阅者）泄露包含敏感API密钥和机密的设置信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Directory Kit | 0 ~ 1.5.5 | - |
II. Public POCs for CVE-2026-16594
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16594
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-16594 (1)
- 🔗 WP Directory Kit < 1.5.5 – Subscriber+ Plugin Settings and API Key Disclosure | CVE 2026-16594 | Plugin Vulnerabilities Read full article exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-08 · 17 CVEs total
| CVE-2026-16955 | AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription | |
| CVE-2026-16953 | AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Sess | |
| CVE-2026-16595 | WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure | |
| CVE-2026-16608 | Download Monitor < 5.2.6 - Unauthenticated Download Log Injection | |
| CVE-2026-16948 | Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Expo | |
| CVE-2026-16590 | WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure | |
| CVE-2026-16578 | Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST R | |
| CVE-2026-16574 | Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Download | |
| CVE-2026-16562 | WP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers | |
| CVE-2026-16589 | WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter | |
| CVE-2026-16535 | Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel | |
| CVE-2026-16282 | Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost P | |
| CVE-2026-16558 | YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema | |
| CVE-2026-16269 | Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling | |
| CVE-2026-16559 | YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload | |
| CVE-2026-16267 | Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field |
IV. Related Vulnerabilities
Same product: WP Directory Kit
- CVE-2026-18653
WP Directory Kit < 1.5.7 - Admin+ SQL Injection via section - CVE-2026-28001
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection v - CVE-2026-27538
WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection v - CVE-2026-18474
WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via - CVE-2026-18230
WP Directory Kit < 1.5.6 - Subscriber+ SQL Injection via sec
Same vendor: Unknown
- CVE-2026-14832
ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated - CVE-2026-13700
WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery - CVE-2026-19726
Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configura - CVE-2026-19728
Extra Product Options Builder for WooCommerce < 1.2.176 - Un - CVE-2026-19725
WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path
V. Comments for CVE-2026-16594
No comments yet