{"id":"CVE-2026-105993","kind":"vulnerability","aliases":["CVE-2026-105993"],"related":[],"title":"DT Directory Lite Addon WordPress plugin lets anyone change its settings","description":"The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.","summary":"The DT Directory Lite Addon WordPress plugin through version 1.1 skips nonce and capability checks on its settings handlers. An unauthenticated attacker can change the plugin's configuration and skin options.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `DT Directory Lite Addon` plugin is installed on the WordPress site and note its version, which is `1.1` or earlier in the affected range.","fix":null,"status":"open","published_at":"2026-11-03T06:17:37+00:00","first_seen_at":"2026-11-03T06:18:59+00:00","triaged_at":"2026-11-03T06:20:50+00:00","updated_at":"2026-11-03T06:20:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T06:20:50Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"DT Directory Lite Addon WordPress plugin lets anyone change its settings","impact":"low","summary":"The DT Directory Lite Addon WordPress plugin through version 1.1 skips nonce and capability checks on its settings handlers. An unauthenticated attacker can change the plugin's configuration and skin options.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker alters plugin configuration and skin options remotely","analyst_note":"Confirm the affected version range and whether a fixed release exists; check the plugin's WordPress.org or vendor page, which the sources did not link.","how_to_check":"- Check whether the `DT Directory Lite Addon` plugin is installed on the WordPress site and note its version, which is `1.1` or earlier in the affected range.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the DT Directory Lite Addon WordPress plugin version 1.1 or earlier are exposed, because its settings handlers accept requests without checking who sends them. Sites without this plugin are not affected. The sources do not say whether non-default configuration is needed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":4115,"output_tokens":517,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105993':14A,17A '-2026':13A,16A '1.1':32B,62C,87C 'addon':4A,27B,58C,83C 'allow':74C 'anyon':8A 'attack':44B,76C 'capabl':36B,68C 'chang':9A,46B 'check':37B,69C 'configur':50B,89C 'cve':12A,15A 'directori':2A,25B,56C,81C 'dt':1A,24B,55C,80C 'handler':41B,73C 'let':7A 'lite':3A,26B,57C,82C 'modifi':78C 'nonc':34B,66C 'option':53B,92C 'packag':18B 'perform':65C 'plugin':6A,22B,29B,48B,60C,85C 'set':11A,40B,72C 'skin':52B,91C 'skip':33B 'unauthent':43B,75C 'version':31B 'wordpress':5A,19B,21B,28B,59C,84C 'wordpress-plugin':20B","nicknames":[],"mitigations":[],"who_affected":"Sites running the DT Directory Lite Addon WordPress plugin version 1.1 or earlier are exposed, because its settings handlers accept requests without checking who sends them. Sites without this plugin are not affected. The sources do not say whether non-default configuration is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wordpress","wordpressplugin"],"first_public_at":"2026-11-03T06:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105993","severity":null,"published_at":"2026-11-03T06:17:37+00:00","modified_at":"2026-11-03T06:17:37+00:00","first_seen_at":"2026-11-03T06:18:59+00:00","fetched_at":"2026-11-03T06:18:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}