CVE-2026-118418 · Runtime
NO FIX YET · SEE WHAT TO DO
The WP Directory Kit WordPress plugin before 1.6.3 does not limit which database models and columns its public directory-search action returns, and it skips authorisation checks on that action. An unauthenticated attacker can read other users' personal data, including email addresses, logins and private contact-form submissions.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the WP Directory Kit plugin before 1.6.3 with its public directory-search action reachable by anyone. The sources do not say whether a non-default setting is needed, so assume any site with the plugin active is exposed until it is updated.
Not affected if plugin-not-installed, version-1.6.3-or-later
Who cares self-hosted, wordpress, wp-directory-kit
1.6.3.wp-directory-kit in wp-content/plugins/.1.6.3 or later.The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and private contact-form submissions.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.