WordPress Plugin Vulnerabilities

Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR

Description

The plugin does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to create payment-attempt records against other users' orders.

Proof of Concept

Affects Plugins

Plugin icon
directorist
Fixed in 8.11

References

CVE
CVE-2026-118534

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
ilqar rahimli
Submitter
ilqar rahimli
Verified
Yes
WPVDB ID
1cc11436-a4ea-4a6e-b163-f37bcd8a3bd8

Timeline

Publicly Published
2026-11-05 (about 2 days ago)
Added
2026-11-05 (about 1 day ago)
Last Updated
2026-11-05 (about 1 day ago)

Other

Published
Title
Published
2025-03-12
Title
Business Directory Plugin - Easy Listing Directories for WordPress < 6.4.15 - Insecure Direct Object Reference to Listing Arbitrary Image Addition
Published
2026-02-11
Title
Cnvrse < 026.02.10.20 - Unauthenticated Insecure Direct Object Reference
Published
2026-11-05
Title
Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR
Published
2026-04-14
Title
Login as User <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation via 'oclaup_original_admin' Cookie
Published
2024-03-28
Title
ProfileGrid < 5.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference