{"id":"CVE-2026-118532","kind":"vulnerability","aliases":["CVE-2026-118532"],"related":[],"title":"Directorist WordPress plugin: subscribers can delete any media attachment","description":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their files.","summary":"The Directorist WordPress plugin before 8.11 does not check who owns attachment IDs sent when a listing's images are updated. A logged-in subscriber can permanently delete any media library file, including files uploaded by administrators.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["directorist","package","self-hosted","wordpress"],"not_affected_if":["no-subscriber-accounts","version-8.11-or-later"],"how_to_check":"- Check the installed Directorist version in the WordPress admin plugin list, or in `wp-content/plugins/directorist/` (the plugin header version).\n- Confirm whether subscriber accounts can register or log in on the site.","fix":"- Directorist: `8.11` or later (per the description, versions before 8.11 are affected).","status":"open","published_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:30+00:00","updated_at":"2026-11-07T06:48:30+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T06:48:30Z","model":"claude-haiku-5-5","output":{"fix":"- Directorist: `8.11` or later (per the description, versions before 8.11 are affected).","reach":"internet","title":"Directorist WordPress plugin: subscribers can delete any media attachment","impact":"medium","summary":"The Directorist WordPress plugin before 8.11 does not check who owns attachment IDs sent when a listing's images are updated. A logged-in subscriber can permanently delete any media library file, including files uploaded by administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","directorist","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Any media library file, including admin uploads, is permanently deleted.","analyst_note":"","how_to_check":"- Check the installed Directorist version in the WordPress admin plugin list, or in `wp-content/plugins/directorist/` (the plugin header version).\n- Confirm whether subscriber accounts can register or log in on the site.","plain_action":"","needs_analyst":false,"not_affected_if":["version-8.11-or-later","no-subscriber-accounts"],"who_is_affected":"Sites running the Directorist plugin before 8.11 that let users register or log in with subscriber-level accounts. Any logged-in subscriber can delete media attachments site-wide, so sites with only admin-created accounts are less exposed. Sites on 8.11 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4243,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118532':12A,15A '-2026':11A,14A '8.11':27B,73C 'access':95C 'ad':69C 'administr':59B,109C 'ai':63C 'ai-pow':62C 'allow':88C 'along':110C 'arbitrari':101C 'attach':9A,33B,79C,104C 'authent':89C 'busi':65C 'check':30B 'classifi':68C 'cve':10A,13A 'delet':6A,50B,100C 'directori':66C 'directorist':1A,16B,23B,61C 'file':54B,56B,113C 'host':20B 'id':34B,80C 'imag':40B,87C 'includ':55B,105C 'level':94C 'librari':53B,103C 'list':38B,67C,85C 'log':45B 'logged-in':44B 'media':8A,52B,102C 'own':32B 'ownership':77C 'packag':17B 'perman':49B,99C 'plugin':3A,25B,71C 'power':64C 'self':19B 'self-host':18B 'sent':35B 'subscrib':4A,47B,93C 'subscriber-level':92C 'suppli':81C 'updat':42B,83C 'upload':57B,107C 'user':90C 'verifi':76C 'wordpress':2A,21B,24B,70C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Directorist plugin before 8.11 that let users register or log in with subscriber-level accounts. Any logged-in subscriber can delete media attachments site-wide, so sites with only admin-created accounts are less exposed. Sites on 8.11 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["directorist","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-118532':12A,15A '-2026':11A,14A 'attach':9A 'cve':10A,13A 'delet':6A 'directorist':1A 'media':8A 'plugin':3A 'subscrib':4A 'wordpress':2A","search_b":"'8.11':27B 'administr':59B 'attach':33B 'check':30B 'delet':50B 'directorist':16B,23B 'file':54B,56B 'host':20B 'id':34B 'imag':40B 'includ':55B 'librari':53B 'list':38B 'log':45B 'logged-in':44B 'media':52B 'own':32B 'packag':17B 'perman':49B 'plugin':25B 'self':19B 'self-host':18B 'sent':35B 'subscrib':47B 'updat':42B 'upload':57B 'wordpress':21B,24B","search_c":"'8.11':73C 'access':95C 'ad':69C 'administr':109C 'ai':63C 'ai-pow':62C 'allow':88C 'along':110C 'arbitrari':101C 'attach':79C,104C 'authent':89C 'busi':65C 'classifi':68C 'delet':100C 'directori':66C 'directorist':61C 'file':113C 'id':80C 'imag':87C 'includ':105C 'level':94C 'librari':103C 'list':67C,85C 'media':102C 'ownership':77C 'perman':99C 'plugin':71C 'power':64C 'subscrib':93C 'subscriber-level':92C 'suppli':81C 'updat':83C 'upload':107C 'user':90C 'verifi':76C 'wordpress':70C","first_public_at":"2026-11-07T06:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118532","severity":null,"published_at":"2026-11-07T06:16:57+00:00","modified_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}