Live › vulnerability › CVE-2026-105993
The DT Directory Lite Addon WordPress plugin through version 1.1 skips nonce and capability checks on its settings handlers. An unauthenticated attacker can change the plugin's configuration and skin options.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 06:18 UTC. All times on this page are UTC.
Sites running the DT Directory Lite Addon WordPress plugin version 1.1 or earlier are exposed, because its settings handlers accept requests without checking who sends them. Sites without this plugin are not affected. The sources do not say whether non-default configuration is needed.
No product ranges from the sources yet.
DT Directory Lite Addon plugin is installed on the WordPress site and note its version, which is 1.1 or earlier in the affected range.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.
This page as .md · .json · in your agent: get_signal("CVE-2026-105993")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.