{"id":"CVE-2026-118418","published":"2026-11-11T06:17:15.017","lastModified":"2026-11-11T06:17:15.133","description":"The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and private contact-form submissions.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/faef9089-6d62-42f4-b507-3c6cc804296a/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}