Insufficient Authentication in Directorist Plugin for WordPress
CVE-2026-118534

Currently unrated

Key Information:

Vendor

WordPress
Status
Directorist: Ai-powered Business Directory, Listings & Classified Ads
Vendor
CVE Published:
7 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-118534?

The Directorist plugin for WordPress, specifically prior to version 8.11, is vulnerable due to a lack of verification processes for its checkout payment-retry REST action. This flaw allows any authenticated user, including those with minimal privileges like subscribers, to create payment-attempt records against orders that do not belong to them. This serious oversight can lead to unauthorized financial transactions and compromise user data, making it crucial for site administrators to update their plugins promptly.

Affected Version(s)

Directorist: AI-Powered Business Directory, Listings & Classified Ads 0 < 8.11

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-118534 - Proof of Concept

References

https://wpscan.com/vulnerability/1cc11436-a4ea-4a6e-b163-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

ilqar rahimli
WPScan
.