{"id":"CVE-2026-118533","kind":"vulnerability","aliases":["CVE-2026-118533"],"related":[],"title":"Directorist WordPress plugin: any logged-in user can read others' payment receipts","description":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.","summary":"The Directorist WordPress plugin before 8.11 does not check that a user requesting an order's payment receipt owns that order. Any logged-in user, including a basic subscriber, can read other customers' order amounts, payment methods, payment status and transaction IDs.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["directorist","package","payments","self-hosted","wordpress"],"not_affected_if":["no-public-registration","plugin-version-8.11-or-later"],"how_to_check":"- Check the installed Directorist plugin version in the WordPress admin Plugins screen; versions below `8.11` are affected.\n- Confirm whether the site accepts open user registration or has subscriber-level accounts, since those accounts are the attack entry point.","fix":"- Directorist: move to `8.11` or later.","status":"open","published_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:26+00:00","updated_at":"2026-11-07T06:48:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T06:48:26Z","model":"claude-haiku-5-5","output":{"fix":"- Directorist: move to `8.11` or later.","reach":"internet","title":"Directorist WordPress plugin: any logged-in user can read others' payment receipts","impact":"medium","summary":"The Directorist WordPress plugin before 8.11 does not check that a user requesting an order's payment receipt owns that order. Any logged-in user, including a basic subscriber, can read other customers' order amounts, payment methods, payment status and transaction IDs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","directorist","payments","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Other customers' order amounts, payment methods and transaction IDs are readable.","analyst_note":"","how_to_check":"- Check the installed Directorist plugin version in the WordPress admin Plugins screen; versions below `8.11` are affected.\n- Confirm whether the site accepts open user registration or has subscriber-level accounts, since those accounts are the attack entry point.","plain_action":"","needs_analyst":false,"not_affected_if":["no-public-registration","plugin-version-8.11-or-later"],"who_is_affected":"Sites running the Directorist plugin before version 8.11 that let people create accounts, such as subscriber accounts from open registration or checkout. Any logged-in user can request receipts, so sites with only admin or staff accounts carry less exposure. Sites not running Directorist are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4238,"output_tokens":547,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118533':16A,19A '-2026':15A,18A '8.11':32B,83C 'ad':79C 'ai':73C 'ai-pow':72C 'allow':99C 'amount':62B,116C 'authent':101C 'basic':55B 'busi':75C 'check':35B 'classifi':78C 'custom':60B 'cve':14A,17A 'directori':76C 'directorist':1A,20B,28B,71C 'disclos':108C 'host':25B 'id':69B,123C 'includ':53B,115C 'inform':114C 'list':77C 'log':6A,50B 'logged-in':5A,49B 'method':64B,118C 'order':41B,47B,61B,92C,98C,111C 'other':11A 'own':45B,96C 'packag':21B 'payment':12A,22B,43B,63B,65B,94C,113C,117C,119C 'plugin':3A,30B,81C 'power':74C 'read':10A,58B 'receipt':13A,44B,95C 'request':39B,90C 'self':24B 'self-host':23B 'status':66B,120C 'subscrib':56B,106C 'transact':68B,122C 'user':8A,38B,52B,89C,102C,110C 'verifi':86C 'wordpress':2A,26B,29B,80C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Directorist plugin before version 8.11 that let people create accounts, such as subscriber accounts from open registration or checkout. Any logged-in user can request receipts, so sites with only admin or staff accounts carry less exposure. Sites not running Directorist are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["directorist","medium","package","payments","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-118533':16A,19A '-2026':15A,18A 'cve':14A,17A 'directorist':1A 'log':6A 'logged-in':5A 'other':11A 'payment':12A 'plugin':3A 'read':10A 'receipt':13A 'user':8A 'wordpress':2A","search_b":"'8.11':32B 'amount':62B 'basic':55B 'check':35B 'custom':60B 'directorist':20B,28B 'host':25B 'id':69B 'includ':53B 'log':50B 'logged-in':49B 'method':64B 'order':41B,47B,61B 'own':45B 'packag':21B 'payment':22B,43B,63B,65B 'plugin':30B 'read':58B 'receipt':44B 'request':39B 'self':24B 'self-host':23B 'status':66B 'subscrib':56B 'transact':68B 'user':38B,52B 'wordpress':26B,29B","search_c":"'8.11':83C 'ad':79C 'ai':73C 'ai-pow':72C 'allow':99C 'amount':116C 'authent':101C 'busi':75C 'classifi':78C 'directori':76C 'directorist':71C 'disclos':108C 'id':123C 'includ':115C 'inform':114C 'list':77C 'method':118C 'order':92C,98C,111C 'own':96C 'payment':94C,113C,117C,119C 'plugin':81C 'power':74C 'receipt':95C 'request':90C 'status':120C 'subscrib':106C 'transact':122C 'user':89C,102C,110C 'verifi':86C 'wordpress':80C","first_public_at":"2026-11-07T06:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118533","severity":null,"published_at":"2026-11-07T06:16:57+00:00","modified_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}