Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.11 - Authenticated (Subscriber+) Incorrect Authorization to Listing Moderation Bypass via REST Listing Status Update
- ID
- WPSEC-2026-2757
- Plugin
- Directorist: AI-Powered Business Directory, Listings & Classified Ads (directorist)
- Affected
- from 8.8.1 before 8.11.1
- Remediation
- Update to 8.11.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-11-09
- Attack surface
- Directorist: AI-Powered Business Directory, Listings & Classified Ads on WPSec AttackSurface
- Fix released
- Published
Description
The Directorist plugin for WordPress is vulnerable to unauthorized modification of data via the REST listing update-status endpoint in versions 8.8.1 up to, and including, 8.11, due to an incomplete authorization check. The endpoint lets any listing owner who holds the listing publish capability, which the plugin grants to subscribers by default, set the status to 'publish'. Only listings in the 'pending' status were blocked, and the requested status was never checked against the directory's moderation policy. This makes it possible for authenticated attackers with subscriber-level access and above to republish their own listings that an administrator has rejected, or that are expired, draft or private, without administrator approval.
References
- https://wpsec.com/vuln/WPSEC-2026-2757/
- https://plugins.svn.wordpress.org/directorist/tags/8.11.1/
- https://wordpress.org/plugins/directorist/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS