CVE-2023-41875 is a medium severity (CVSS 5.3) missing authorization flaw in WP Directory Kit, a WordPress plugin, in versions through 1.2.6. Patchstack lists 1.2.7 as the patched version. The vector needs no login, so update the plugin on any site that has it installed.
What's affected
The NVD record says WP Directory Kit is affected "from n/a through 1.2.6". Patchstack, which we read, agrees, lists 1.2.7 as the patched version and labels it a low priority broken access control issue with CVSS 5.3.
The record and Patchstack agree on the score. The record's vector shows no privileges are required, which is why the number is not lower.
The record scores the flaw 5.3 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. It can be reached over the network, the attack complexity is low, it requires no privileges, and it needs no user interaction. The impact on confidentiality is low, on integrity no and on availability no. The weakness class is CWE-862 (missing authorization). The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
Check the plugin version on every WordPress site you run. If you have WP-CLI access:
wp plugin get wpdirectorykit --fields=name,status,version
Or open Plugins in the dashboard and read the version under WP Directory Kit. Anything at or below 1.2.6 is in the affected range. Patchstack lists 1.2.7 as the patched version. Do not forget staging copies and rarely visited sites, and remove plugins you no longer use.
What to do now
- Update WP Directory Kit to 1.2.7 or later. With WP-CLI:
wp plugin update wpdirectorykit. - Check whether directory listings on the site expose data you consider private.
- Add the plugin to your inventory so future advisories reach you.
Why it matters
The weakness is CWE-862, missing authorization. The vector shows a network attack path, low complexity, no privileges and no user interaction, with a low confidentiality impact. In short, an anonymous visitor may be able to read something that should be gated.
The confidentiality impact is low, so this is not an emergency. It is still the kind of bug that scanners find quickly on public sites, so a prompt update is cheap insurance. Also decide what the directory data on your site is meant to show; if some fields are private, confirm after the update that they are not served to anonymous visitors.
Quick check
Does an attacker need an account?
The vector says no privileges are required, so the weakness can be reached without signing in.
Which version is fixed?
Patchstack lists 1.2.7. The record names 1.2.6 and earlier as affected.
Sources
Last reviewed: 19 October 2026.
