# Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.11 - Authenticated (Subscriber+) Incorrect Authorization to Listing Moderation Bypass via MCP Change Listing Status Tool

- **ID:** WPSEC-2026-2756
- **Plugin:** Directorist: AI-Powered Business Directory, Listings & Classified Ads (`directorist`), https://wordpress.org/plugins/directorist/
- **Affected versions:** from 8.11 before 8.11.1
- **Fixed in:** 8.11.1 (Update to 8.11.1 or later.)
- **Severity:** Low 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions None seen (as of 2026-11-09)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/directorist
- **Fix released:** 2026-11-08
- **Published:** 2026-11-09
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2756/

## Description

The Directorist plugin for WordPress is vulnerable to unauthorized modification of data via the MCP change-listing-status tool in version 8.11, due to the tool accepting a 'publish' transition for any listing owner who holds the listing publish capability, without checking the directory's moderation policy or the listing's pending state. This makes it possible for authenticated attackers with subscriber-level access and above to publish their own pending or draft listings without administrator approval, when the site administrator has enabled the plugin's MCP integration.

## References

- https://wpsec.com/vuln/WPSEC-2026-2756/
- https://plugins.svn.wordpress.org/directorist/tags/8.11.1/
- https://wordpress.org/plugins/directorist/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2756/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.