PT-2026-40420 · Wp Directory Kit · Wp Directory Kit

CVE-2026-39534 · Published 2026-05-12 · Updated 2026-06-15

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Directory Kit versions prior to 1.5.1

Description An unauthenticated broken access control issue exists, which could expose customer databases. Approximately 3,000 WordPress sites are potentially affected worldwide.

Recommendations Update to a version later than 1.5.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-39534

Affected Products

Wp Directory Kit

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-39534 · Security Note
• https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-5-0-broken-access-control-vulnerability?_s_id=cve · Note
• https://twitter.com/UndercodeUpdate/status/2054239487819927693 · Twitter Post