CVE-2026-16590

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.5

Description An issue exists where the plugin fails to perform authorization or nonce checks on an authenticated AJAX action. This allows any authenticated user, including those with Subscriber privileges, to retrieve stored contact messages and associated user data belonging to other users. A nonce is a unique token used to protect against cross-site request forgery (CSRF) by ensuring that a request was intentionally sent by the user.

Recommendations Update WP Directory Kit to version 1.5.5 or later.