CVE-2026-118529: Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout

Q: Who can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can exploit it. The attacker must be able to identify another user's pending listing.

Q: What configuration is required for exploitation?

The featured-listing fee must be configured as zero. The vulnerable plugin must be a version before 8.11.

Q: What is the impact of a successful exploit?

An attacker can cause another user's pending listing to be published and marked as featured without owning that listing.

Q: How can I tell whether my site may be affected?

Sites using Directorist versions before 8.11 may be affected if they allow authenticated users and have a zero-cost featured-listing checkout. Review pending listings for unexpected publication or featured status changes.

Published Nov 7, 2026

Updated

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's pending listing when the featured listing fee is set to zero.

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user, including a user with only the Subscriber role, can exploit it. The attacker must be able to identify another user's pending listing.

What configuration is required for exploitation?

The featured-listing fee must be configured as zero. The vulnerable plugin must be a version before 8.11.

What is the impact of a successful exploit?

An attacker can cause another user's pending listing to be published and marked as featured without owning that listing.

How can I tell whether my site may be affected?

Sites using Directorist versions before 8.11 may be affected if they allow authenticated users and have a zero-cost featured-listing checkout. Review pending listings for unexpected publication or featured status changes.

CVE-2026-118529: Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout

Event History

Frequently Asked Questions

Who can exploit this issue?

What configuration is required for exploitation?

What is the impact of a successful exploit?

How can I tell whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What configuration is required for exploitation?

What is the impact of a successful exploit?

How can I tell whether my site may be affected?