CVE-2026-16594

This CVE carries a 7.5 rating, but treat it as a credential-compromise incident, not a medium-severity information-disclosure finding. The vulnerability allows any Subscriber-level user—WordPress's lowest privilege role—to retrieve plugin settings via an unauthenticated AJAX endpoint. Those settings contain API keys and secrets for external services. The CVSS score measures the technical flaw, not what those credentials unlock: payment gateways, third-party directory APIs, email services. Each represents lateral movement into infrastructure your WordPress security never governed. The first IR action is credential rotation, not patching. Patch to 1.5.5 by all means, but assume keys were harvested the moment the vulnerable version shipped. Identify every external service configured in WP Directory Kit, regenerate its API credentials, update the configuration, and validate the integration still functions. This remediation window extends past the patch date because third-party APIs don't know your plugin was vulnerable. Two questions will determine your true exposure. First: were the exposed keys per-installation credentials or a shared token for the plugin vendor's own service? If the latter, key rotation on your end doesn't neutralize the harvest—the attacker still has the token that works across every installation. Contact the vendor to确认 whether the exposed credential was centralized and whether they've rotated their side. Second: how did the attacker obtain Subscriber access in the first place? Subscriber accounts often require separate exploitation or stale credentials from abandoned plugins. Audit what else that account can reach beyond this endpoint—it's likely a second-stage foothold you hadn't scoped. The broader pattern matters here. WordPress plugins exposing credentials to low-privilege users constitute a documented exploitation class since 2019. Your threat model likely assumed Subscriber access was contained. This CVE confirms it isn't. Assume contained access is a failure mode, not a guarantee.

Reviewed through automated stages and approved by a human before publication.