Email Verification Manipulation in Directorist Plugin for WordPress
CVE-2026-118530
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 November 2026
Badges
What is CVE-2026-118530?
The Directorist plugin prior to version 8.11 for WordPress has a vulnerability that allows unauthorized users to manipulate email-verification processes in a multisite environment. This flaw enables an administrator from one site in the network to lock out users from other sites, including the network's Super Administrator. The lack of proper checks on user permissions during email verification bulk actions could result in disruptions and loss of access for legitimate users until they re-verify their emails. It is essential for administrators to update their Directorist installations to mitigate the risk associated with this vulnerability.
Affected Version(s)
Directorist: AI-Powered Business Directory, Listings & Classified Ads 0 < 8.11
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.