{
 "id": "WPSEC-2026-2729",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2729/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2729/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2729/index.md",
 "title": "WP Directory Kit <= 1.5.9 - Unauthenticated Sensitive Information Exposure via Front-End AJAX Select, Treefield and Results Endpoints",
 "description": "The WP Directory Kit plugin for WordPress is vulnerable to Sensitive Information Exposure via its select_2_ajax, treefield and results/map front-end AJAX functions in all versions up to, and including, 1.5.9. This is due to these functions returning the columns named in the request, accepting any model name, and returning unpublished listings. This makes it possible for unauthenticated attackers to extract data from listings that should not be public and from other plugin tables.",
 "plugin": {
  "slug": "wpdirectorykit",
  "name": "WP Directory Kit",
  "full_name": "WP Directory Kit",
  "wordpress_org": "https://wordpress.org/plugins/wpdirectorykit/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpdirectorykit/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpdirectorykit"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.6.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.6.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.6.1",
 "remediation": "Update to 1.6.1 or later.",
 "fix_released": "2026-11-06T20:47:36+00:00",
 "published": "2026-11-07T21:41:07+00:00",
 "updated": "2026-11-07T11:11:35.855448+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2729/",
  "https://plugins.svn.wordpress.org/wpdirectorykit/tags/1.6.1/",
  "https://wordpress.org/plugins/wpdirectorykit/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpdirectorykit",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-08"
 }
}