CVE-2026-118531: Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update

Q: Who can exploit this issue?

Any authenticated user with a Subscriber-level account or higher can exploit it, but only for a listing they authored.

Q: What does an attacker need to do?

The attacker needs a pending listing of their own and access to the plugin's REST status-update functionality. They can then change that listing's status from pending to published without administrator approval.

Q: Are sites using listing moderation affected?

Sites relying on administrator review of pending listings are affected if they use a Directorist version earlier than 8.11.1. The issue defeats moderation by allowing listing authors to publish their own submissions.

Q: How can I tell whether this has already been abused?

Review published listings created by Subscriber-level or other non-administrative users, particularly listings that appear to have moved from pending to published without an administrator's approval.

Published Nov 12, 2026

Updated

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing moderation and publish their own pending listings.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Directorist: AI-Powered Business Directory, Listings & Classified Ads to a version that resolves this vulnerability.
Fixed in 8.11.1

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated user with a Subscriber-level account or higher can exploit it, but only for a listing they authored.

What does an attacker need to do?

The attacker needs a pending listing of their own and access to the plugin's REST status-update functionality. They can then change that listing's status from pending to published without administrator approval.

Are sites using listing moderation affected?

Sites relying on administrator review of pending listings are affected if they use a Directorist version earlier than 8.11.1. The issue defeats moderation by allowing listing authors to publish their own submissions.

How can I tell whether this has already been abused?

Review published listings created by Subscriber-level or other non-administrative users, particularly listings that appear to have moved from pending to published without an administrator's approval.

CVE-2026-118531: Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do?

Are sites using listing moderation affected?

How can I tell whether this has already been abused?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do?

Are sites using listing moderation affected?

How can I tell whether this has already been abused?