Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-13920

WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

The WP Directory Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the wdk_public_action AJAX handler. This makes it possible for unauthenticated attackers to extract email addresses for users with Directory Kit-specific user roles.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

wpdirectorykit WP Directory Kit

Default version status: unaffected

  • 0 to ≤ 1.4.9affected

References