CVE-2026-16590

WP Directory Kit prior to version 1.5.5 has an authorization/nonce check flaw in an authenticated AJAX action, enabling any authenticated user (e.g., Subscriber) to retrieve other users’ stored contact messages and related user data. Root cause: missing access control on the AJAX endpoint. Impact...