{
 "id": "WPSEC-2026-2567",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2567/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2567/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2567/index.md",
 "title": "Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via Listing Images",
 "description": "The Directorist plugin for WordPress is vulnerable to Insecure Direct Object Reference via the listing image handling in all versions up to, and including, 8.10.7 due to missing ownership validation when processing listing attachments. This makes it possible for authenticated attackers, with subscriber-level access and above, to attach media they do not own to their listings and to permanently delete media attachments belonging to other users.",
 "plugin": {
  "slug": "directorist",
  "name": "Directorist: AI-Powered Business Directory, Listings & Classified Ads",
  "full_name": "Directorist: AI-Powered Business Directory, Listings & Classified Ads",
  "wordpress_org": "https://wordpress.org/plugins/directorist/",
  "advisories_url": "https://wpsec.com/vuln/plugin/directorist/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/directorist"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.11"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.11",
 "remediation": "Update to 8.11 or later.",
 "fix_released": "2026-11-04T10:04:10+00:00",
 "published": "2026-11-05T10:46:15+00:00",
 "updated": "2026-11-04T13:57:48.861872+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2567/",
  "https://plugins.svn.wordpress.org/directorist/tags/8.11/",
  "https://wordpress.org/plugins/directorist/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/directorist",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-05"
 }
}