{"affected":[{"defaultStatus":"unaffected","product":"WP Directory Kit","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.6.3","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118418","cwes":["CWE-200"],"description":"The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and private contact-form submissions.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/faef9089-6d62-42f4-b507-3c6cc804296a/"}],"kev":null,"metrics":[],"modifiedAt":1794376808671,"publishedAt":1794376808671,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/faef9089-6d62-42f4-b507-3c6cc804296a/"}],"remediation":[],"revision":"874f1f7f3f99bbd3524349a88ca073ee0e9c36fed08c839c419d5905f4503155","sources":[{"modifiedAt":1794376808671,"name":"CNA: WPScan","retrievedAt":1794377373770,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118418"}],"ssvc":null,"status":"published","title":"WP Directory Kit < 1.6.3 - Unauthenticated User Data and Contact Message Disclosure","updatedAt":1794377373770}