CVE-2026-17092: Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directoristnonce and atbdpnoncejs are exposed to all logged-in users via wplocalizescript.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker does not need to own the targeted listing and can delete listings belonging to other users.
Are private and unpublished listings affected?
Yes. An attacker can delete arbitrary directory listings in published, draft, or private status.
Do the endpoint nonces prevent exploitation?
No. Both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users through wp_localize_script, so they do not provide an authorization barrier.
Which plugin versions are affected?
All versions up to and including 8.10.2.1 are affected.