WordPress Plugin Vulnerabilities

DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings Update

Description

The plugin does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the plugin's configuration and skin options.

Proof of Concept

Affects Plugins

Plugin icon
dt-directory-lite-addon
No known fix

References

CVE
CVE-2026-105993

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Usama Arshad
Submitter
Usama Arshad
Submitter website
https://www.usamaarshad.me/
Submitter twitter
usama0x01
Verified
Yes
WPVDB ID
7a71b710-5022-4692-aae8-f6da7ac8b664

Timeline

Publicly Published
2026-10-31 (about 2 days ago)
Added
2026-10-24 (about 9 days ago)
Last Updated
2026-10-24 (about 9 days ago)

Other

Published
Title
Published
2025-05-16
Title
EventON - WordPress Virtual Event Calendar Plugin < 4.9.7 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2025-03-18
Title
Altair < 5.2.5 - Unauthenticated Arbitrary Options Update via pp_import_current
Published
2025-03-27
Title
WpEvently < 4.3.0 - Missing Authorization
Published
2025-09-22
Title
Frontend File Manager < 23.4 - Missing Authorization
Published
2026-02-18
Title
NitroPack < 1.19.4 - Missing Authorization