low2.7
CVE-2026-16592
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as …
Impact
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
Affected products
| Product | Affected versions |
|---|---|
| WP Directory Kit WordPress Plugin | through 1.5.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.