CVE-2026-118528 · Package
NO FIX YET · SEE WHAT TO DO
The Directorist WordPress plugin before 8.11 returns listing metadata through an AJAX action without checking that the requester owns the listing. A logged-in subscriber can read other users' private and unpublished draft listings, including contact information.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Directorist WordPress plugin before 8.11 where anyone can register an account with at least Subscriber access. The flaw exposes draft and private listing details, including contact information, to those logged-in users. Sites that do not allow public registration or do not run this plugin can skip it.
Not affected if no-public-registration, plugin-not-installed
Who cares directorist, self-hosted, wordpress
8.11.8.11 or later (the sources state the fix is in 8.11).The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above to disclose another user's private and unpublished draft listing details, including contact information.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.