{"id":"CVE-2026-118530","kind":"vulnerability","aliases":["CVE-2026-118530"],"related":[],"title":"WordPress Directorist plugin lets a site admin lock out network users","description":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out users of other sites, including the network Super Administrator, until they re-verify their email.","summary":"The Directorist WordPress plugin before 8.11 fails to check permissions on an email-verification bulk action on multisite networks. An Administrator of one site can force users of other sites, including the network Super Administrator, to re-verify their email and lose access.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["directorist","multisite","runtime","wordpress"],"not_affected_if":["single-site-install","version-8.11-or-later"],"how_to_check":"- Check the installed Directorist plugin version in the WordPress plugins screen or `wp plugin get directorist --field=version` if WP-CLI is available\n- Confirm whether the site runs as a WordPress multisite network","fix":"- Directorist: move to `8.11` or later (per the description, versions before 8.11 are affected)","status":"open","published_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:29+00:00","updated_at":"2026-11-07T06:48:29+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-07T06:48:29Z","model":"claude-haiku-5-5","output":{"fix":"- Directorist: move to `8.11` or later (per the description, versions before 8.11 are affected)","reach":"network","title":"WordPress Directorist plugin lets a site admin lock out network users","impact":"low","summary":"The Directorist WordPress plugin before 8.11 fails to check permissions on an email-verification bulk action on multisite networks. An Administrator of one site can force users of other sites, including the network Super Administrator, to re-verify their email and lose access.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","multisite","directorist"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"a site admin locks out other sites' users, including the Super Administrator","analyst_note":"","how_to_check":"- Check the installed Directorist plugin version in the WordPress plugins screen or `wp plugin get directorist --field=version` if WP-CLI is available\n- Confirm whether the site runs as a WordPress multisite network","plain_action":"","needs_analyst":false,"not_affected_if":["single-site-install","version-8.11-or-later"],"who_is_affected":"Only WordPress multisite networks running Directorist before 8.11 are exposed, since the flaw needs a site Administrator acting across sites. Single-site installs are not described as affected. Teams that run a multisite network with several site admins should upgrade first.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":4241,"output_tokens":519,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118530':14A,17A '-2026':13A,16A '8.11':27B,80C 'access':66B 'act':86C 'action':38B,100C 'ad':76C 'admin':7A 'administr':43B,57B,105C,123C 'ai':70C 'ai-pow':69C 'allow':103C 'bulk':37B,99C 'busi':72C 'check':30B,83C 'classifi':75C 'cve':12A,15A 'directori':73C 'directorist':2A,18B,23B,68C 'edit':89C 'email':35B,63B,97C,130C 'email-verif':34B,96C 'fail':28B 'forc':48B 'handl':94C 'includ':53B,119C 'let':4A 'list':74C 'lock':8A,113C 'lose':65B 'may':88C 'multisit':19B,40B,102C 'network':10A,41B,55B,111C,121C 'one':45B,107C 'permiss':31B 'plugin':3A,25B,78C 'power':71C 're':60B,127C 're-verifi':59B,126C 'runtim':20B 'site':6A,46B,52B,108C,118C 'super':56B,122C 'target':91C 'user':11A,49B,87C,92C,115C 'verif':36B,98C 'verifi':61B,128C 'wordpress':1A,21B,24B,77C","nicknames":[],"mitigations":[],"who_affected":"Only WordPress multisite networks running Directorist before 8.11 are exposed, since the flaw needs a site Administrator acting across sites. Single-site installs are not described as affected. Teams that run a multisite network with several site admins should upgrade first.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["directorist","medium","multisite","runtime","wordpress"],"campaign_type":null,"search_a":"'-118530':14A,17A '-2026':13A,16A 'admin':7A 'cve':12A,15A 'directorist':2A 'let':4A 'lock':8A 'network':10A 'plugin':3A 'site':6A 'user':11A 'wordpress':1A","search_b":"'8.11':27B 'access':66B 'action':38B 'administr':43B,57B 'bulk':37B 'check':30B 'directorist':18B,23B 'email':35B,63B 'email-verif':34B 'fail':28B 'forc':48B 'includ':53B 'lose':65B 'multisit':19B,40B 'network':41B,55B 'one':45B 'permiss':31B 'plugin':25B 're':60B 're-verifi':59B 'runtim':20B 'site':46B,52B 'super':56B 'user':49B 'verif':36B 'verifi':61B 'wordpress':21B,24B","search_c":"'8.11':80C 'act':86C 'action':100C 'ad':76C 'administr':105C,123C 'ai':70C 'ai-pow':69C 'allow':103C 'bulk':99C 'busi':72C 'check':83C 'classifi':75C 'directori':73C 'directorist':68C 'edit':89C 'email':97C,130C 'email-verif':96C 'handl':94C 'includ':119C 'list':74C 'lock':113C 'may':88C 'multisit':102C 'network':111C,121C 'one':107C 'plugin':78C 'power':71C 're':127C 're-verifi':126C 'site':108C,118C 'super':122C 'target':91C 'user':87C,92C,115C 'verif':98C 'verifi':128C 'wordpress':77C","first_public_at":"2026-11-07T06:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118530","severity":null,"published_at":"2026-11-07T06:16:57+00:00","modified_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}