CVE-2026-118530: Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action

Q: Which deployments are exposed to cross-site account lockout?

WordPress multisite networks using a Directorist version before 8.11 are affected. The issue depends on the plugin's email-verification bulk action being available to a site Administrator.

Q: What access does an attacker need?

An attacker needs Administrator privileges on one site in the multisite network. They can then target users associated with other sites, including the network Super Administrator, through the email-verification bulk action.

Q: What is the practical impact of exploitation?

Affected users can be locked out until they complete email re-verification. This can include the network Super Administrator, creating an administrative availability issue across the network.

Q: How can administrators determine whether they may be affected?

Check whether Directorist is installed on a WordPress multisite network and whether its version is earlier than 8.11. Also review whether unexpected email re-verification requirements or lockouts have affected users from other sites on the network.

Published Nov 7, 2026

Updated

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out users of other sites, including the network Super Administrator, until they re-verify their email.

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Which deployments are exposed to cross-site account lockout?

WordPress multisite networks using a Directorist version before 8.11 are affected. The issue depends on the plugin's email-verification bulk action being available to a site Administrator.

What access does an attacker need?

An attacker needs Administrator privileges on one site in the multisite network. They can then target users associated with other sites, including the network Super Administrator, through the email-verification bulk action.

What is the practical impact of exploitation?

Affected users can be locked out until they complete email re-verification. This can include the network Super Administrator, creating an administrative availability issue across the network.

How can administrators determine whether they may be affected?

Check whether Directorist is installed on a WordPress multisite network and whether its version is earlier than 8.11. Also review whether unexpected email re-verification requirements or lockouts have affected users from other sites on the network.

CVE-2026-118530: Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action

Event History

Frequently Asked Questions

Which deployments are exposed to cross-site account lockout?

What access does an attacker need?

What is the practical impact of exploitation?

How can administrators determine whether they may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to cross-site account lockout?

What access does an attacker need?

What is the practical impact of exploitation?

How can administrators determine whether they may be affected?