{
 "id": "WPSEC-2026-2756",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2756/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2756/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2756/index.md",
 "title": "Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.11 - Authenticated (Subscriber+) Incorrect Authorization to Listing Moderation Bypass via MCP Change Listing Status Tool",
 "description": "The Directorist plugin for WordPress is vulnerable to unauthorized modification of data via the MCP change-listing-status tool in version 8.11, due to the tool accepting a 'publish' transition for any listing owner who holds the listing publish capability, without checking the directory's moderation policy or the listing's pending state. This makes it possible for authenticated attackers with subscriber-level access and above to publish their own pending or draft listings without administrator approval, when the site administrator has enabled the plugin's MCP integration.",
 "plugin": {
  "slug": "directorist",
  "name": "Directorist: AI-Powered Business Directory, Listings & Classified Ads",
  "full_name": "Directorist: AI-Powered Business Directory, Listings & Classified Ads",
  "wordpress_org": "https://wordpress.org/plugins/directorist/",
  "advisories_url": "https://wpsec.com/vuln/plugin/directorist/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/directorist"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "8.11",
    "from_inclusive": true,
    "to": "8.11.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 8.11 before 8.11.1"
  ]
 },
 "introduced_in": "8.11",
 "fixed_in": "8.11.1",
 "remediation": "Update to 8.11.1 or later.",
 "fix_released": "2026-11-08T09:47:29+00:00",
 "published": "2026-11-09T10:53:09+00:00",
 "updated": "2026-11-08T13:08:01.652838+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2756/",
  "https://plugins.svn.wordpress.org/directorist/tags/8.11.1/",
  "https://wordpress.org/plugins/directorist/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/directorist",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "None seen",
  "as_of": "2026-11-09"
 }
}