The vulnerability arises because WP Directory Kit’s authenticated AJAX action lacks authorization and nonce checks. An authenticated user, even with a low‑privilege role such as Subscriber, can invoke the action and retrieve the plugin’s settings, including sensitive API keys and secrets. The primary risk is that attackers can obtain confidential credentials, potentially granting them further system access or enabling exfiltration of protected data. This constitutes a serious data‑exposure weakness.

All installations of the WP Directory Kit WordPress plugin older than version 1.5.5 are impacted. The affected product is the WP Directory Kit plugin for WordPress, and any site running a pre‑1.5.5 release is vulnerable, regardless of the WordPress core version.

The exploit requires only that the user be authenticated; a standard Subscriber account suffices. While public EPSS data is unavailable and the vulnerability is not listed in the KEV catalog, the lack of proper access control (CWE‑284) and absence of nonce verification (CWE‑200) make exploitation straightforward for any internal attacker. The CVSS score is not provided, but the impact of leaking API secrets can be high. The attack vector is authenticated, local to the WordPress admin area, and does not require network-level exploitation.