{"id":"CVE-2026-118529","kind":"vulnerability","aliases":["CVE-2026-118529"],"related":[],"title":"Directorist WordPress plugin lets any logged-in user feature others' listings","description":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's pending listing when the featured listing fee is set to zero.","summary":"The Directorist WordPress plugin before 8.11 does not check that a user owns a listing before processing its featured-listing checkout. Any logged-in user, including a subscriber, can publish and feature another user's pending listing when the featured listing fee is set to zero.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["directorist","package","wordpress"],"not_affected_if":["featured-fee-above-zero","no-user-registration","version-8.11-or-later"],"how_to_check":"- Look at the installed Directorist plugin version in the WordPress admin Plugins page; it is affected below `8.11`.\n- Check whether the featured listing fee is set to zero in the Directorist settings.","fix":"- Directorist: move to `8.11` or later","status":"open","published_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:03+00:00","triaged_at":"2026-11-07T06:48:30+00:00","updated_at":"2026-11-07T06:48:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T06:48:30Z","model":"claude-haiku-5-5","output":{"fix":"- Directorist: move to `8.11` or later","reach":"internet","title":"Directorist WordPress plugin lets any logged-in user feature others' listings","impact":"low","summary":"The Directorist WordPress plugin before 8.11 does not check that a user owns a listing before processing its featured-listing checkout. Any logged-in user, including a subscriber, can publish and feature another user's pending listing when the featured listing fee is set to zero.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","directorist"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Any logged-in user can publish and feature other users' listings","analyst_note":"","how_to_check":"- Look at the installed Directorist plugin version in the WordPress admin Plugins page; it is affected below `8.11`.\n- Check whether the featured listing fee is set to zero in the Directorist settings.\n- unknown for other checks","plain_action":"","needs_analyst":false,"not_affected_if":["version-8.11-or-later","no-user-registration","featured-fee-above-zero"],"who_is_affected":"Sites running the Directorist WordPress plugin before 8.11 that let users register or submit listings, and that have the featured listing fee set to zero. The flaw needs only a logged-in account such as a subscriber, so sites with open registration are most exposed; sites that do not use paid featured listings or keep the fee above zero are not affected by this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4237,"output_tokens":547,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118529':15A,18A '-2026':14A,17A '8.11':27B,83C 'ad':79C 'ai':73C 'ai-pow':72C 'allow':102C 'anoth':56B,114C 'authent':104C 'busi':75C 'check':30B 'checkout':43B,99C 'classifi':78C 'cve':13A,16A 'directori':76C 'directorist':1A,19B,23B,71C 'featur':10A,41B,55B,63B,97C,113C,121C 'featured-list':40B,96C 'fee':65B,123C 'includ':49B 'let':4A 'list':12A,36B,42B,60B,64B,77C,92C,98C,118C,122C 'log':7A,46B 'logged-in':6A,45B 'other':11A 'own':34B,90C 'packag':20B 'pend':59B,117C 'plugin':3A,25B,81C 'power':74C 'process':38B,94C 'publish':53B,111C 'set':67B,125C 'subscrib':51B,109C 'user':9A,33B,48B,57B,89C,105C,115C 'verifi':86C 'wordpress':2A,21B,24B,80C 'zero':69B,127C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Directorist WordPress plugin before 8.11 that let users register or submit listings, and that have the featured listing fee set to zero. The flaw needs only a logged-in account such as a subscriber, so sites with open registration are most exposed; sites that do not use paid featured listings or keep the fee above zero are not affected by this path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["directorist","medium","package","wordpress"],"campaign_type":null,"search_a":"'-118529':15A,18A '-2026':14A,17A 'cve':13A,16A 'directorist':1A 'featur':10A 'let':4A 'list':12A 'log':7A 'logged-in':6A 'other':11A 'plugin':3A 'user':9A 'wordpress':2A","search_b":"'8.11':27B 'anoth':56B 'check':30B 'checkout':43B 'directorist':19B,23B 'featur':41B,55B,63B 'featured-list':40B 'fee':65B 'includ':49B 'list':36B,42B,60B,64B 'log':46B 'logged-in':45B 'own':34B 'packag':20B 'pend':59B 'plugin':25B 'process':38B 'publish':53B 'set':67B 'subscrib':51B 'user':33B,48B,57B 'wordpress':21B,24B 'zero':69B","search_c":"'8.11':83C 'ad':79C 'ai':73C 'ai-pow':72C 'allow':102C 'anoth':114C 'authent':104C 'busi':75C 'checkout':99C 'classifi':78C 'directori':76C 'directorist':71C 'featur':97C,113C,121C 'featured-list':96C 'fee':123C 'list':77C,92C,98C,118C,122C 'own':90C 'pend':117C 'plugin':81C 'power':74C 'process':94C 'publish':111C 'set':125C 'subscrib':109C 'user':89C,105C,115C 'verifi':86C 'wordpress':80C 'zero':127C","first_public_at":"2026-11-07T06:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118529","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118529","severity":null,"published_at":"2026-11-07T06:16:57+00:00","modified_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:03+00:00","fetched_at":"2026-11-07T06:46:03+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}