WordPress Plugin Vulnerabilities

Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR

Description

The plugin does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above to disclose another user's private and unpublished draft listing details, including contact information.

Proof of Concept

Affects Plugins

Plugin icon
directorist
Fixed in 8.11

References

CVE
CVE-2026-118528

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nicat Sultanov
Submitter
Nicat Sultanov
Submitter website
https://github.com/Sultan0f1
Verified
Yes
WPVDB ID
c138ecf0-1d27-4250-accc-e6e7581b6e60

Timeline

Publicly Published
2026-11-05 (about 2 days ago)
Added
2026-11-05 (about 1 day ago)
Last Updated
2026-11-05 (about 1 day ago)

Other

Published
Title
Published
2025-11-20
Title
Return Refund and Exchange For WooCommerce < 4.5.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation
Published
2025-04-11
Title
User Registration & Membership – Custom Registration Form, Login Form, and User Profile < 4.1.4 - Insecure Direct Object Reference to Unauthenticated Membership Modification
Published
2026-01-27
Title
Document Embedder < 2.0.5 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion
Published
2024-11-20
Title
If-So Dynamic Content Personalization < 1.9.2.2 - Authenticated (Contributor+) Post Disclosure
Published
2025-08-15
Title
School Management <= 93.1.0 - Unauthenticated Insecure Direct Object Reference