Unauthorized Access Issue in Directorist Plugin for WordPress
CVE-2026-118532
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 7 November 2026
Badges
What is CVE-2026-118532?
The Directorist plugin for WordPress prior to version 8.11 contains a significant access control vulnerability. This flaw allows authenticated users with Subscriber-level roles and higher to exploit the plugin's features. Specifically, the vulnerability arises from insufficient verification of attachment IDs during the process of updating listing images. As a result, these users can delete arbitrary media library attachments, even those belonging to administrators. This poses a serious risk as sensitive files can be permanently removed without proper authorization.
Affected Version(s)
Directorist: AI-Powered Business Directory, Listings & Classified Ads 0 < 8.11
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.