Authorization Bypass Vulnerability in Directorist Plugin for WordPress

CVE-2026-17092

What is CVE-2026-17092?

The Directorist plugin for WordPress is affected by an authorization bypass vulnerability that allows authenticated users, including those with subscriber-level access, to delete business directory listings arbitrarily. This vulnerability stems from the plugin's failure to properly authenticate user actions, as the nonces used for security (directorist_nonce and atbdp_nonce_js) are visible to all logged-in users. This lack of sufficient authorization checks could lead to unwanted data loss, making it crucial for site administrators to secure their installations against potential exploitation by malicious users.

References