CVE-2026-18232: Unknown Wp Directory Kit

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.

Affected products

• Unknown Wp Directory Kit: up to and including 1.5.7

Published 2026-09-15. Last modified 2026-09-16.