The WP Directory Kit plugin for WordPress is affected by a Sensitive Information Exposure flaw that allows an unauthenticated attacker to retrieve email addresses associated with Directory Kit-specific user roles through the AJAX handler wdk_public_action. This functionality can expose personally identifiable information without any authentication context.

All WordPress sites running WP Directory Kit version 1.4.9 or earlier are impacted, regardless of other plugins or themes. The vulnerability arises from the AJAX endpoint wdk_public_action within the plugin.

The CVSS score of 5.3 indicates moderate severity, while an EPSS score below 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting it is not a known target of active exploit campaigns. Attackers would need only to send a crafted AJAX request to the vulnerable endpoint, which is publicly accessible, but there is no known active exploit or exploitation evidence at this time.