CVE-2026-118533 · Package
NO FIX YET · SEE WHAT TO DO
The Directorist WordPress plugin before 8.11 does not check that a user requesting an order's payment receipt owns that order. Any logged-in user, including a basic subscriber, can read other customers' order amounts, payment methods, payment status and transaction IDs.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Directorist plugin before version 8.11 that let people create accounts, such as subscriber accounts from open registration or checkout. Any logged-in user can request receipts, so sites with only admin or staff accounts carry less exposure. Sites not running Directorist are not affected.
Not affected if no-public-registration, plugin-version-8.11-or-later
Who cares directorist, payments, self-hosted, wordpress
8.11 are affected.8.11 or later.The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.