CVE-2026-16592

LowCVSS 2.7/10Last modified Sep 16, 2026

Description

The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2026
Last modified: Sep 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-165936.8The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, CVE-2026-165947.5The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, CVE-2026-165956.5The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, CVE-2026-165966.5The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to,CVE-2026-165977.2The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommer CVE-2026-165995.1GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the CVE-2026-16606.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.CVE-2026-166007.7The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-CVE-2026-166018.8The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Uploa CVE-2026-166027.5The Passster WordPress plugin before 4.3.6 does not perform a post-status check before returning post content from an unauthenticated REST CVE-2026-166037.5The Passster WordPress plugin before 4.3.6 does not enforce its category-based content protection on the WordPress REST API, allowing unaut CVE-2026-166047.5The Passster WordPress plugin before 4.3.6 outputs password-protected block content in the public page response before verifying the passwo