CVE-2026-118418 | BDVDB-2026-404786 Detail
WP Directory Kit
Description#
The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and private contact-form submissions.
Impact#
No impact statement in the source data.
Weaknesses#
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References#
Exploit#
History#
- Version 1Record published in the CVE List.