Description
The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WP Directory Kit | ≤ 1.5.7 | — |
References
- https://wpscan.com/vulnerability/69d10ee3-0d36-47d1-b5bf-88b8516d99f4/ exploit vdb-entry technical-description