WP Directory Kit <1.5.7 Unauthenticated User Email Disclosure via select_2_ajax_user (CVE-2026-18231)

Vulnerability Overview Vulnerability Name: WP Directory Kit < 1.5.7 - Unauthenticated User Email Disclosure via select_2_ajax_user Description: This plugin performs no authorization checks on its public AJAX operations and returns unfiltered database rows, allowing unauthenticated attackers to retrieve usernames and email addresses of users holding roles defined by the plugin itself. CVE ID: CVE-2026-18231 Classification: - Type: SENSITIVE DATA DISCLOSURE - OWASP Top 10: A3: Sensitive Data Exposure - CWE: CWE-200 - CVSS: 5.3 (medium) Affected Scope Affected Plugin: wpdirectorykit Fixed Version: 1.5.7 Remediation Fixed Version: Upgrade to version 1.5.7 or higher. Timeline Public Disclosure Date: 2026-08-17 Date Added: 2026-08-17 Last Updated: 2026-08-17 Additional Information Original Researcher: Erwan LR (WPScan) Submitter: Erwan LR (WPScan) Verification Status: Yes WPVDB ID: c4508c33-40ac-42c6-aa7e-cf9004d38bd Related Vulnerabilities 2026-07-01: Kirki < 6.0.12 - Unauthenticated Sensitive Data Exposure via kirki_post_apis_nopriv AJAX Action 2024-12-23: BookingPress < 11.23 - Unauthenticated Export File Download 2024-02-20: Backup Bolt < 1.4.0 - Sensitive Data Exposure 2024-12-17: Accept Authorize.NET Payments Using Contact Form 7 < 2.3 - Unauthenticated Information Exposure 2022-08-01: Duplicator < 1.4.71 - Unauthenticated System Information Disclosure POC Code POC Code: Specific POC code is not provided; it is noted that the POC will be revealed on 2026-08-31 to give users time to update.

Goal Reached Thanks to every supporter — we hit 100%!

WP Directory Kit <1.5.7 Unauthenticated User Email Disclosure via select_2_ajax_user (CVE-2026-18231)

More from this source