CVE-2026-118529 · Package
NO FIX YET · SEE WHAT TO DO
The Directorist WordPress plugin before 8.11 does not check that a user owns a listing before processing its featured-listing checkout. Any logged-in user, including a subscriber, can publish and feature another user's pending listing when the featured listing fee is set to zero.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Directorist WordPress plugin before 8.11 that let users register or submit listings, and that have the featured listing fee set to zero. The flaw needs only a logged-in account such as a subscriber, so sites with open registration are most exposed; sites that do not use paid featured listings or keep the fee above zero are not affected by this path.
Not affected if featured-fee-above-zero, no-user-registration, version-8.11-or-later
Who cares directorist, wordpress
8.11.8.11 or laterThe Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's pending listing when the featured listing fee is set to zero.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.