An authorization flaw in the WP Directory Kit WordPress plugin allows authenticated users to exfiltrate sensitive configuration data, posing a significant risk to site security.

The plugin lacks necessary authorization and nonce verification on specific AJAX endpoints, which permits any authenticated user, such as a Subscriber, to access and disclose internal plugin settings.

The exposure of sensitive API keys and secrets can lead to the compromise of third party services integrated with the WordPress site. While the CVSS score is 7.5, the potential for unauthorized access to administrative credentials and external service tokens represents a high severity threat to operational security and data integrity.

Immediate Action: Update the WP Directory Kit plugin to version 1.5.5 or later immediately.

Proactive Monitoring: Review access logs for suspicious requests directed at AJAX endpoints associated with the wpdirectorykit plugin.

Compensating Controls: Implement a Web Application Firewall (WAF) to block unauthorized requests to the plugin AJAX interface until the update is applied.

Public Exploit Available: Unknown.

Given the exposure of sensitive credentials, administrators should prioritize updating to version 1.5.5 immediately. Furthermore, if the plugin was previously installed, perform an audit of all API keys and secrets stored within the plugin settings to determine if rotation is necessary after applying the patch.