Vulnerabilities / Directorist: AI-Powered Business Directory, Listings & Classified Ads / WPSEC-2026-2567
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via Listing Images
Medium 5.4
CWE-639Fixed in 8.11
- ID
- WPSEC-2026-2567
- Plugin
- Directorist: AI-Powered Business Directory, Listings & Classified Ads (directorist)
- Affected
- all versions before 8.11
- Remediation
- Update to 8.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-05
- Attack surface
- Directorist: AI-Powered Business Directory, Listings & Classified Ads on WPSec AttackSurface
- Fix released
- Published
Description
The Directorist plugin for WordPress is vulnerable to Insecure Direct Object Reference via the listing image handling in all versions up to, and including, 8.10.7 due to missing ownership validation when processing listing attachments. This makes it possible for authenticated attackers, with subscriber-level access and above, to attach media they do not own to their listings and to permanently delete media attachments belonging to other users.
References
- https://wpsec.com/vuln/WPSEC-2026-2567/
- https://plugins.svn.wordpress.org/directorist/tags/8.11/
- https://wordpress.org/plugins/directorist/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS