Description
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Directory Kit | < 1.5.5 | 1.5.5 |
References
- https://wpscan.com/vulnerability/d055d385-7e8a-4179-aa21-f07e240fd181/ exploit vdb-entry technical-description