Vulnerabilities / Directorist: AI-Powered Business Directory, Listings & Classified Ads / WPSEC-2026-2756
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.11 - Authenticated (Subscriber+) Incorrect Authorization to Listing Moderation Bypass via MCP Change Listing Status Tool
Low 3.1
CWE-863Fixed in 8.11.1
- ID
- WPSEC-2026-2756
- Plugin
- Directorist: AI-Powered Business Directory, Listings & Classified Ads (directorist)
- Affected
- from 8.11 before 8.11.1
- Remediation
- Update to 8.11.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions None seen among sites WPSec scans, 2026-11-09
- Attack surface
- Directorist: AI-Powered Business Directory, Listings & Classified Ads on WPSec AttackSurface
- Fix released
- Published
Description
The Directorist plugin for WordPress is vulnerable to unauthorized modification of data via the MCP change-listing-status tool in version 8.11, due to the tool accepting a 'publish' transition for any listing owner who holds the listing publish capability, without checking the directory's moderation policy or the listing's pending state. This makes it possible for authenticated attackers with subscriber-level access and above to publish their own pending or draft listings without administrator approval, when the site administrator has enabled the plugin's MCP integration.
References
- https://wpsec.com/vuln/WPSEC-2026-2756/
- https://plugins.svn.wordpress.org/directorist/tags/8.11.1/
- https://wordpress.org/plugins/directorist/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS