CVE-2026-16592
The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.
- Published Sep 15, 2026
- CVSS 2.7 low
- 0.2% chance of exploitation in the next 30 days (EPSS)