CVE-2026-59518: WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability
Published Jul 13, 2026
·Updated
Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8.8.2.
Affected Software
2 affected components
WordPress Directorist>=n/a<=8.8.2
Directorist<=8.8.2
Event History
Jul 13, 2026
CVE Published
via MITRE·08:41 AM
Data Sourced
via MITRE·08:41 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-59518?
CVE-2026-59518 has a critical severity score of 9.8.
2
How do I fix CVE-2026-59518?
To fix CVE-2026-59518, update the WordPress Directorist plugin to the latest version.
3
What vulnerability is associated with CVE-2026-59518?
CVE-2026-59518 is associated with a PHP Object Injection vulnerability in the WordPress Directorist plugin.
4
What versions of the Directorist plugin are affected by CVE-2026-59518?
CVE-2026-59518 affects all versions of the Directorist plugin up to and including 8.8.2.
5
What type of impact does CVE-2026-59518 have?
CVE-2026-59518 allows for potential remote code execution due to deserialization of untrusted data.