CVE-2026-18232CWE-200information-disclosure

CVE-2026-18232

Medium · published September 15, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
10.1
In the wild
Unconfirmed
What it is

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00206 · 10.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-15T10:16Z
References (1)
https://wpscan.com/vulnerability/69d10ee3-0d36-47d1-b5bf-88b8516d99f4/ · [email protected]
EPSS history
Timeline
  • 16 SEP 04:25Z
    EPSS moved — → 0%
    epss
  • 15 SEP 06:00Z
    WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow
    cvelistv5