{"id":"CVE-2026-118418","kind":"vulnerability","aliases":["CVE-2026-118418"],"related":[],"title":"WP Directory Kit WordPress plugin exposes user emails and private form submissions","description":"The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and private contact-form submissions.","summary":"The WP Directory Kit WordPress plugin before 1.6.3 does not limit which database models and columns its public directory-search action returns, and it skips authorisation checks on that action. An unauthenticated attacker can read other users' personal data, including email addresses, logins and private contact-form submissions.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["runtime","self-hosted","wordpress","wp-directory-kit"],"not_affected_if":["plugin-not-installed","version-1.6.3-or-later"],"how_to_check":"- Check the installed version of the WP Directory Kit plugin in the WordPress admin under Plugins, and flag any version below `1.6.3`.\n- Look for the plugin folder named like `wp-directory-kit` in `wp-content/plugins/`.","fix":"- WP Directory Kit (WordPress plugin): upgrade to `1.6.3` or later.","status":"open","published_at":"2026-11-11T06:17:15+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","triaged_at":"2026-11-11T06:27:45+00:00","updated_at":"2026-11-11T06:27:45+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T06:27:45Z","model":"claude-haiku-5-5","output":{"fix":"- WP Directory Kit (WordPress plugin): upgrade to `1.6.3` or later.","reach":"internet","title":"WP Directory Kit WordPress plugin exposes user emails and private form submissions","impact":"medium","summary":"The WP Directory Kit WordPress plugin before 1.6.3 does not limit which database models and columns its public directory-search action returns, and it skips authorisation checks on that action. An unauthenticated attacker can read other users' personal data, including email addresses, logins and private contact-form submissions.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","wp-directory-kit","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attackers read user emails, logins and private form submissions","analyst_note":"Confirm from the NVD entry or the plugin's changelog whether the directory-search action is enabled by default and which exact endpoint is affected.","how_to_check":"- Check the installed version of the WP Directory Kit plugin in the WordPress admin under Plugins, and flag any version below `1.6.3`.\n- Look for the plugin folder named like `wp-directory-kit` in `wp-content/plugins/`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-1.6.3-or-later"],"who_is_affected":"Sites running the WP Directory Kit plugin before 1.6.3 with its public directory-search action reachable by anyone. The sources do not say whether a non-default setting is needed, so assume any site with the plugin active is exposed until it is updated.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000759,"input_tokens":4542,"output_tokens":610,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118418':15A,18A '-2026':14A,17A '1.6.3':35B,85C 'action':49B,58B,99C 'address':70B,118C 'allow':107C 'attack':61B,109C 'authoris':54B,104C 'check':55B 'column':43B,93C 'contact':75B,124C 'contact-form':74B,123C 'cve':13A,16A 'data':67B,115C 'databas':40B,90C 'directori':2A,26B,30B,47B,80C,97C 'directory-search':46B,96C 'email':8A,69B,117C 'expos':6A 'form':11A,76B,125C 'host':22B 'includ':68B,116C 'kit':3A,27B,31B,81C 'limit':38B 'login':71B,120C 'may':100C 'model':41B,91C 'person':66B,114C 'plugin':5A,33B,83C 'privat':10A,73B,122C 'public':45B,95C 'read':63B,111C 'restrict':88C 'return':50B,101C 'runtim':19B 'search':48B,98C 'self':21B 'self-host':20B 'skip':53B 'submiss':12A,77B,126C 'unauthent':60B,108C 'user':7A,65B,113C 'verifi':103C 'wordpress':4A,23B,32B,82C 'wp':1A,25B,29B,79C 'wp-directory-kit':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Directory Kit plugin before 1.6.3 with its public directory-search action reachable by anyone. The sources do not say whether a non-default setting is needed, so assume any site with the plugin active is exposed until it is updated.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","runtime","selfhosted","wordpress","wpdirectorykit"],"campaign_type":null,"search_a":"'-118418':15A,18A '-2026':14A,17A 'cve':13A,16A 'directori':2A 'email':8A 'expos':6A 'form':11A 'kit':3A 'plugin':5A 'privat':10A 'submiss':12A 'user':7A 'wordpress':4A 'wp':1A","search_b":"'1.6.3':35B 'action':49B,58B 'address':70B 'attack':61B 'authoris':54B 'check':55B 'column':43B 'contact':75B 'contact-form':74B 'data':67B 'databas':40B 'directori':26B,30B,47B 'directory-search':46B 'email':69B 'form':76B 'host':22B 'includ':68B 'kit':27B,31B 'limit':38B 'login':71B 'model':41B 'person':66B 'plugin':33B 'privat':73B 'public':45B 'read':63B 'return':50B 'runtim':19B 'search':48B 'self':21B 'self-host':20B 'skip':53B 'submiss':77B 'unauthent':60B 'user':65B 'wordpress':23B,32B 'wp':25B,29B 'wp-directory-kit':24B","search_c":"'1.6.3':85C 'action':99C 'address':118C 'allow':107C 'attack':109C 'authoris':104C 'column':93C 'contact':124C 'contact-form':123C 'data':115C 'databas':90C 'directori':80C,97C 'directory-search':96C 'email':117C 'form':125C 'includ':116C 'kit':81C 'login':120C 'may':100C 'model':91C 'person':114C 'plugin':83C 'privat':122C 'public':95C 'read':111C 'restrict':88C 'return':101C 'search':98C 'submiss':126C 'unauthent':108C 'user':113C 'verifi':103C 'wordpress':82C 'wp':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118418","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118418","severity":null,"published_at":"2026-11-11T06:17:15+00:00","modified_at":"2026-11-11T06:17:15+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","fetched_at":"2026-11-11T06:25:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}