CVE-2026-18232

The WP Directory Kit WordPress plugin through version 1.5.7 is vulnerable to unauthenticated unpublished listing disclosure. The root cause is that the public AJAX action map_infowindow does not verify the status or ownership of a listing before returning its content, allowing any unauthenticated...

WordPress WP Directory Kit plugin <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure vulnerability

Unauthenticated Unpublished Listing Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions = 1.5.7...