Vulnerability · Published Nov 7, 2026 · Assigned by WPScan
CVE-2026-118529Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout
Low 3.1
In plain English
A low-severity incorrect authorization in Directorist: AI-Powered Business Directory, Listings & Classified Ads from Unknown. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's pending listing when the featured listing fee is set to zero.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 0 – before 8.11 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/1fd42aa7-97d2-48e9-9935-b413fadbad2f/ exploit, vdb-entry, technical-description