CyberRota Analysis
AI-GeneratedThe WP Directory Kit plugin for WordPress prior to version 1.5.5 is vulnerable due to a lack of authorization and nonce checks on an authenticated AJAX action, which permits any authenticated user, including those with minimal permissions like Subscribers, to access sensitive settings, including API keys and secrets. This vulnerability poses a risk of unauthorized information disclosure, potentially leading to further exploitation. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and secrets.