{"id":"CVE-2026-118531","kind":"vulnerability","aliases":["CVE-2026-118531"],"related":[],"title":"Directorist WordPress plugin: authors can publish their own pending listings","description":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing moderation and publish their own pending listings.","summary":"The Directorist WordPress plugin before 8.11.1 lets a listing's author change its status from pending to published. A Subscriber-level account can therefore skip the administrator's moderation of listings.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["directorist","package","wordpress"],"not_affected_if":["no-user-submissions","version-8.11.1-or-later"],"how_to_check":"- Check the installed Directorist plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Confirm whether the site accepts listing submissions from Subscriber-level users.","fix":"- Update the Directorist plugin to `8.11.1` or later.","status":"open","published_at":"2026-11-12T06:17:11+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","triaged_at":"2026-11-12T06:38:01+00:00","updated_at":"2026-11-12T06:38:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T06:38:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Directorist plugin to `8.11.1` or later.","reach":"network","title":"Directorist WordPress plugin: authors can publish their own pending listings","impact":"low","summary":"The Directorist WordPress plugin before 8.11.1 lets a listing's author change its status from pending to published. A Subscriber-level account can therefore skip the administrator's moderation of listings.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","directorist"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"unmoderated listings published on the site by registered users","analyst_note":"","how_to_check":"- Check the installed Directorist plugin version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Confirm whether the site accepts listing submissions from Subscriber-level users.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.11.1-or-later","no-user-submissions"],"who_is_affected":"Sites running the Directorist WordPress plugin before 8.11.1 that let registered users submit listings. The flaw allows a listing author to bypass admin moderation, so the impact is limited to unreviewed content appearing on the site. Sites that do not accept user submissions, or that run 8.11.1 or later, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000709,"input_tokens":4559,"output_tokens":506,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118531':13A,16A '-2026':12A,15A '8.11.1':25B,65C 'account':42B,89C 'ad':61C 'administr':47B,95C 'ai':55C 'ai-pow':54C 'allow':82C 'author':4A,30B,73C 'busi':57C 'bypass':93C 'chang':31B,75C 'classifi':60C 'cve':11A,14A 'directori':58C 'directorist':1A,17B,21B,53C 'let':26B 'level':41B,88C 'list':10A,28B,51B,59C,70C,97C,104C 'moder':49B,98C 'packag':18B 'pend':9A,35B,79C,103C 'plugin':3A,23B,63C 'power':56C 'prevent':68C 'publish':6A,37B,81C,100C 'skip':45B 'status':33B,77C 'subscrib':40B,87C 'subscriber-level':39B,86C 'therefor':44B 'user':83C 'wordpress':2A,19B,22B,62C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Directorist WordPress plugin before 8.11.1 that let registered users submit listings. The flaw allows a listing author to bypass admin moderation, so the impact is limited to unreviewed content appearing on the site. Sites that do not accept user submissions, or that run 8.11.1 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["directorist","low","package","wordpress"],"campaign_type":null,"search_a":"'-118531':13A,16A '-2026':12A,15A 'author':4A 'cve':11A,14A 'directorist':1A 'list':10A 'pend':9A 'plugin':3A 'publish':6A 'wordpress':2A","search_b":"'8.11.1':25B 'account':42B 'administr':47B 'author':30B 'chang':31B 'directorist':17B,21B 'let':26B 'level':41B 'list':28B,51B 'moder':49B 'packag':18B 'pend':35B 'plugin':23B 'publish':37B 'skip':45B 'status':33B 'subscrib':40B 'subscriber-level':39B 'therefor':44B 'wordpress':19B,22B","search_c":"'8.11.1':65C 'account':89C 'ad':61C 'administr':95C 'ai':55C 'ai-pow':54C 'allow':82C 'author':73C 'busi':57C 'bypass':93C 'chang':75C 'classifi':60C 'directori':58C 'directorist':53C 'level':88C 'list':59C,70C,97C,104C 'moder':98C 'pend':79C,103C 'plugin':63C 'power':56C 'prevent':68C 'publish':81C,100C 'status':77C 'subscrib':87C 'subscriber-level':86C 'user':83C 'wordpress':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118531","severity":null,"published_at":"2026-11-12T06:17:11+00:00","modified_at":"2026-11-12T06:17:11+00:00","first_seen_at":"2026-11-12T06:36:51+00:00","fetched_at":"2026-11-12T06:36:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}