---
id: "CVE-2026-105993"
kind: "vulnerability"
aliases: ["CVE-2026-105993"]
title: "DT Directory Lite Addon WordPress plugin lets anyone change its settings"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-03T06:17:37+00:00"
first_seen_at: "2026-11-03T06:18:59+00:00"
updated_at: "2026-11-03T06:20:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105993", "first_seen_at": "2026-11-03T06:18:59+00:00"}]
---

# DT Directory Lite Addon WordPress plugin lets anyone change its settings

The DT Directory Lite Addon WordPress plugin through version 1.1 skips nonce and capability checks on its settings handlers. An unauthenticated attacker can change the plugin's configuration and skin options.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `DT Directory Lite Addon` plugin is installed on the WordPress site and note its version, which is `1.1` or earlier in the affected range.

## Timeline

- 2026-11-03T06:18:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105993

## From the sources

The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_