CVE-2026-118532: Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field

Q: Who can exploit this issue?

Any authenticated user with Subscriber-level access or higher can exploit it. The attacker does not need to own the targeted media attachment.

Q: What can be deleted?

An attacker can permanently delete arbitrary WordPress media library attachments, including files uploaded by administrators. The deletion includes the attachment records and their associated files.

Q: Which installations are affected?

Directorist versions before 8.11 are affected when users can update a listing's images and supply attachment IDs. The issue is in the plugin's handling of attachment ownership during listing image updates.

Q: How can administrators look for possible exploitation?

Review unexpected media-library deletions, particularly administrator-uploaded attachments that disappeared after listing image updates by lower-privileged accounts. Investigate listing update activity from Subscriber or other non-administrative users around the time affected files were removed.

Published Nov 7, 2026

Updated

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their files.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Directorist: AI-Powered Business Directory, Listings & Classified Ads to a version that resolves this vulnerability.
Fixed in 8.11

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated user with Subscriber-level access or higher can exploit it. The attacker does not need to own the targeted media attachment.

What can be deleted?

An attacker can permanently delete arbitrary WordPress media library attachments, including files uploaded by administrators. The deletion includes the attachment records and their associated files.

Which installations are affected?

Directorist versions before 8.11 are affected when users can update a listing's images and supply attachment IDs. The issue is in the plugin's handling of attachment ownership during listing image updates.

How can administrators look for possible exploitation?

Review unexpected media-library deletions, particularly administrator-uploaded attachments that disappeared after listing image updates by lower-privileged accounts. Investigate listing update activity from Subscriber or other non-administrative users around the time affected files were removed.

CVE-2026-118532: Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What can be deleted?

Which installations are affected?

How can administrators look for possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can be deleted?

Which installations are affected?

How can administrators look for possible exploitation?