{"id":"CVE-2026-118534","kind":"vulnerability","aliases":["CVE-2026-118534"],"related":[],"title":"Directorist WordPress plugin: any logged-in user can retry others' orders","description":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to create payment-attempt records against other users' orders.","summary":"The Directorist WordPress plugin before 8.11 does not check that an order used by its checkout payment-retry REST action belongs to the requesting user. An authenticated user, including a subscriber, can create payment-attempt records against other users' orders.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["directorist","package","payments","wordpress"],"not_affected_if":["no-user-registration","plugin-not-installed"],"how_to_check":"- Check the installed Directorist version in the WordPress plugins screen or `wp plugin get directorist --field=version`\n- Confirm whether the site accepts customer accounts with the subscriber role","fix":"- Directorist: `8.11` or later (the plugin's version before 8.11 is affected)","status":"open","published_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:26+00:00","updated_at":"2026-11-07T06:48:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T06:48:26Z","model":"claude-haiku-5-5","output":{"fix":"- Directorist: `8.11` or later (the plugin's version before 8.11 is affected)","reach":"internet","title":"Directorist WordPress plugin: any logged-in user can retry others' orders","impact":"medium","summary":"The Directorist WordPress plugin before 8.11 does not check that an order used by its checkout payment-retry REST action belongs to the requesting user. An authenticated user, including a subscriber, can create payment-attempt records against other users' orders.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","directorist","payments"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"logged-in users create payment attempts against other customers' orders","analyst_note":"","how_to_check":"- Check the installed Directorist version in the WordPress plugins screen or `wp plugin get directorist --field=version`\n- Confirm whether the site accepts customer accounts with the subscriber role","plain_action":"","needs_analyst":false,"not_affected_if":["no-user-registration","plugin-not-installed"],"who_is_affected":"Sites running the Directorist WordPress plugin before 8.11 that let users register or log in and use its checkout payment flow. Sites without customer accounts or without the payment-retry feature in use are less exposed. The sources do not say whether a default configuration exposes the flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00068,"input_tokens":4232,"output_tokens":513,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118534':15A,18A '-2026':14A,17A '8.11':28B,78C 'action':43B,93C 'ad':74C 'ai':68C 'ai-pow':67C 'allow':99C 'attempt':59B,111C 'authent':50B,101C 'belong':44B,94C 'busi':70C 'check':31B 'checkout':38B,88C 'classifi':73C 'creat':56B,108C 'cve':13A,16A 'directori':71C 'directorist':1A,19B,24B,66C 'includ':52B 'list':72C 'log':6A 'logged-in':5A 'order':12A,34B,64B,84C,116C 'other':11A 'packag':20B 'payment':21B,40B,58B,90C,110C 'payment-attempt':57B,109C 'payment-retri':39B,89C 'plugin':3A,26B,76C 'power':69C 'record':60B,112C 'request':47B,97C 'rest':42B,92C 'retri':10A,41B,91C 'subscrib':54B,106C 'target':85C 'use':35B 'user':8A,48B,51B,63B,98C,102C,115C 'verifi':81C 'wordpress':2A,22B,25B,75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Directorist WordPress plugin before 8.11 that let users register or log in and use its checkout payment flow. Sites without customer accounts or without the payment-retry feature in use are less exposed. The sources do not say whether a default configuration exposes the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["directorist","medium","package","payments","wordpress"],"campaign_type":null,"search_a":"'-118534':15A,18A '-2026':14A,17A 'cve':13A,16A 'directorist':1A 'log':6A 'logged-in':5A 'order':12A 'other':11A 'plugin':3A 'retri':10A 'user':8A 'wordpress':2A","search_b":"'8.11':28B 'action':43B 'attempt':59B 'authent':50B 'belong':44B 'check':31B 'checkout':38B 'creat':56B 'directorist':19B,24B 'includ':52B 'order':34B,64B 'packag':20B 'payment':21B,40B,58B 'payment-attempt':57B 'payment-retri':39B 'plugin':26B 'record':60B 'request':47B 'rest':42B 'retri':41B 'subscrib':54B 'use':35B 'user':48B,51B,63B 'wordpress':22B,25B","search_c":"'8.11':78C 'action':93C 'ad':74C 'ai':68C 'ai-pow':67C 'allow':99C 'attempt':111C 'authent':101C 'belong':94C 'busi':70C 'checkout':88C 'classifi':73C 'creat':108C 'directori':71C 'directorist':66C 'list':72C 'order':84C,116C 'payment':90C,110C 'payment-attempt':109C 'payment-retri':89C 'plugin':76C 'power':69C 'record':112C 'request':97C 'rest':92C 'retri':91C 'subscrib':106C 'target':85C 'user':98C,102C,115C 'verifi':81C 'wordpress':75C","first_public_at":"2026-11-07T06:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118534","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118534","severity":null,"published_at":"2026-11-07T06:16:57+00:00","modified_at":"2026-11-07T06:16:57+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}