What’s Vulnerable › Vulnerabilities

CVE-2023-2280: WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-09 · updated 2026-06-17
• Weakness: CWE-862

Description

The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajax_public' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin settings, import demo data, delete Directory Kit related posts and terms, and install arbitrary plugins. A partial patch was introduced in version 1.2.0 and an additional partial patch was introduced in version 1.2.2, but the issue was not fully patched until 1.2.3.

Affected products

• wpdirectorykit WP Directory Kit: before 1.2.3 — fixed in 1.2.3

How to fix

Upgrade to a fixed version: wpdirectorykit WP Directory Kit 1.2.3. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.1.8/public/class-wpdirectorykit-public.php#L249
• https://plugins.trac.wordpress.org/changeset/2907164/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/abb1a758-5c16-4841-b1c7-0705ab16b328?source=cve
• https://plugins.trac.wordpress.org/browser/wpdirectorykit/tags/1.1.8/public/class-wpdirectorykit-public.php#L249
• https://plugins.trac.wordpress.org/changeset/2907164/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/abb1a758-5c16-4841-b1c7-0705ab16b328?source=cve

Get alerted when CVE-2023-2280 or the next vulnerability affects your stack