WordPress Plugin Vulnerabilities

Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt

Description

The plugin does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.

Proof of Concept

Affects Plugins

Plugin icon
directorist
Fixed in 8.11

References

CVE
CVE-2026-118533

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
ilqar rahimli
Submitter
ilqar rahimli
Verified
Yes
WPVDB ID
a2d9ceb3-e0c8-494c-a664-5da25d1d1282

Timeline

Publicly Published
2026-11-05 (about 2 days ago)
Added
2026-11-05 (about 1 day ago)
Last Updated
2026-11-05 (about 1 day ago)

Other

Published
Title
Published
2024-04-23
Title
EventPrime – Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update
Published
2026-01-24
Title
Job Portal < 2.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-07-08
Title
GamiPress < 7.9.5 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter
Published
2026-01-02
Title
Justicia <= 1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-06-30
Title
LearnPress < 4.4.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter