{"id":"CVE-2026-118528","kind":"vulnerability","aliases":["CVE-2026-118528"],"related":[],"title":"Directorist WordPress plugin: subscribers can read other users' private listings","description":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above to disclose another user's private and unpublished draft listing details, including contact information.","summary":"The Directorist WordPress plugin before 8.11 returns listing metadata through an AJAX action without checking that the requester owns the listing. A logged-in subscriber can read other users' private and unpublished draft listings, including contact information.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["directorist","package","self-hosted","wordpress"],"not_affected_if":["no-public-registration","plugin-not-installed"],"how_to_check":"- Check the installed Directorist plugin version in the WordPress admin under Plugins; compare it with `8.11`.\n- Look for user accounts with the Subscriber role on sites that allow public registration.","fix":"- Directorist plugin: move to `8.11` or later (the sources state the fix is in 8.11).","status":"open","published_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:03+00:00","triaged_at":"2026-11-07T06:48:30+00:00","updated_at":"2026-11-07T06:48:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T06:48:30Z","model":"claude-haiku-5-5","output":{"fix":"- Directorist plugin: move to `8.11` or later (the sources state the fix is in 8.11).","reach":"internet","title":"Directorist WordPress plugin: subscribers can read other users' private listings","impact":"medium","summary":"The Directorist WordPress plugin before 8.11 returns listing metadata through an AJAX action without checking that the requester owns the listing. A logged-in subscriber can read other users' private and unpublished draft listings, including contact information.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","directorist","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Private listing contact details of other users readable by subscribers","analyst_note":"","how_to_check":"- Check the installed Directorist plugin version in the WordPress admin under Plugins; compare it with `8.11`.\n- Look for user accounts with the Subscriber role on sites that allow public registration.","plain_action":"","needs_analyst":false,"not_affected_if":["no-public-registration","plugin-not-installed"],"who_is_affected":"Sites running the Directorist WordPress plugin before 8.11 where anyone can register an account with at least Subscriber access. The flaw exposes draft and private listing details, including contact information, to those logged-in users. Sites that do not allow public registration or do not run this plugin can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000683,"input_tokens":4243,"output_tokens":518,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118528':13A,16A '-2026':12A,15A '8.11':28B,74C 'access':101C 'action':35B,93C 'ad':70C 'ai':64C 'ai-pow':63C 'ajax':34B,92C 'allow':94C 'anoth':106C 'attack':96C 'authent':95C 'busi':66C 'check':37B 'classifi':69C 'contact':59B,116C 'cve':11A,14A 'detail':114C 'directori':67C 'directorist':1A,17B,24B,62C 'disclos':105C 'draft':56B,112C 'host':21B 'includ':58B,115C 'inform':60B,117C 'level':100C 'list':10A,30B,43B,57B,68C,85C,113C 'log':46B 'logged-in':45B 'metadata':31B,89C 'own':41B,82C 'packag':18B 'plugin':3A,26B,72C 'power':65C 'privat':9A,53B,109C 'read':6A,50B 'referenc':84C 'request':40B,80C 'return':29B,87C 'self':20B 'self-host':19B 'subscrib':4A,48B,99C 'subscriber-level':98C 'unpublish':55B,111C 'user':8A,52B,81C,107C 'valid':77C 'via':90C 'without':36B 'wordpress':2A,22B,25B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Directorist WordPress plugin before 8.11 where anyone can register an account with at least Subscriber access. The flaw exposes draft and private listing details, including contact information, to those logged-in users. Sites that do not allow public registration or do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["directorist","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-118528':13A,16A '-2026':12A,15A 'cve':11A,14A 'directorist':1A 'list':10A 'plugin':3A 'privat':9A 'read':6A 'subscrib':4A 'user':8A 'wordpress':2A","search_b":"'8.11':28B 'action':35B 'ajax':34B 'check':37B 'contact':59B 'directorist':17B,24B 'draft':56B 'host':21B 'includ':58B 'inform':60B 'list':30B,43B,57B 'log':46B 'logged-in':45B 'metadata':31B 'own':41B 'packag':18B 'plugin':26B 'privat':53B 'read':50B 'request':40B 'return':29B 'self':20B 'self-host':19B 'subscrib':48B 'unpublish':55B 'user':52B 'without':36B 'wordpress':22B,25B","search_c":"'8.11':74C 'access':101C 'action':93C 'ad':70C 'ai':64C 'ai-pow':63C 'ajax':92C 'allow':94C 'anoth':106C 'attack':96C 'authent':95C 'busi':66C 'classifi':69C 'contact':116C 'detail':114C 'directori':67C 'directorist':62C 'disclos':105C 'draft':112C 'includ':115C 'inform':117C 'level':100C 'list':68C,85C,113C 'metadata':89C 'own':82C 'plugin':72C 'power':65C 'privat':109C 'referenc':84C 'request':80C 'return':87C 'subscrib':99C 'subscriber-level':98C 'unpublish':111C 'user':81C,107C 'valid':77C 'via':90C 'wordpress':71C","first_public_at":"2026-11-07T06:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118528","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118528","severity":null,"published_at":"2026-11-07T06:16:57+00:00","modified_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:03+00:00","fetched_at":"2026-11-07T06:46:03+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}