CVE-2026-118534: Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR

Q: Who can exploit this issue?

Any authenticated WordPress user can exploit it, including users with the Subscriber role. The attacker does not need to own the order they target.

Q: What does exploitation allow an attacker to do?

An attacker can invoke the checkout payment-retry REST action for another user's order and create payment-attempt records against that order. The provided information does not state that the attacker can complete payments, alter orders, or access payment details.

Q: Are sites running version 8.11 affected?

The issue affects Directorist versions before 8.11. Based on the provided version range, version 8.11 is not identified as affected.

Q: What should be checked for possible exploitation?

Review payment-attempt records and checkout payment-retry REST activity for attempts associated with orders whose account owner did not initiate them. Pay particular attention to attempts initiated by low-privileged authenticated accounts, such as subscribers.

Published Nov 7, 2026

Updated

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to create payment-attempt records against other users' orders.

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user can exploit it, including users with the Subscriber role. The attacker does not need to own the order they target.

What does exploitation allow an attacker to do?

An attacker can invoke the checkout payment-retry REST action for another user's order and create payment-attempt records against that order. The provided information does not state that the attacker can complete payments, alter orders, or access payment details.

Are sites running version 8.11 affected?

The issue affects Directorist versions before 8.11. Based on the provided version range, version 8.11 is not identified as affected.

What should be checked for possible exploitation?

Review payment-attempt records and checkout payment-retry REST activity for attempts associated with orders whose account owner did not initiate them. Pay particular attention to attempts initiated by low-privileged authenticated accounts, such as subscribers.

CVE-2026-118534: Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR

Event History

Frequently Asked Questions

Who can exploit this issue?

What does exploitation allow an attacker to do?

Are sites running version 8.11 affected?

What should be checked for possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does exploitation allow an attacker to do?

Are sites running version 8.11 affected?

What should be checked for possible exploitation?