{
 "id": "WPSEC-2026-2757",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2757/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2757/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2757/index.md",
 "title": "Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.11 - Authenticated (Subscriber+) Incorrect Authorization to Listing Moderation Bypass via REST Listing Status Update",
 "description": "The Directorist plugin for WordPress is vulnerable to unauthorized modification of data via the REST listing update-status endpoint in versions 8.8.1 up to, and including, 8.11, due to an incomplete authorization check. The endpoint lets any listing owner who holds the listing publish capability, which the plugin grants to subscribers by default, set the status to 'publish'. Only listings in the 'pending' status were blocked, and the requested status was never checked against the directory's moderation policy. This makes it possible for authenticated attackers with subscriber-level access and above to republish their own listings that an administrator has rejected, or that are expired, draft or private, without administrator approval.",
 "plugin": {
  "slug": "directorist",
  "name": "Directorist: AI-Powered Business Directory, Listings & Classified Ads",
  "full_name": "Directorist: AI-Powered Business Directory, Listings & Classified Ads",
  "wordpress_org": "https://wordpress.org/plugins/directorist/",
  "advisories_url": "https://wpsec.com/vuln/plugin/directorist/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/directorist"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "8.8.1",
    "from_inclusive": true,
    "to": "8.11.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 8.8.1 before 8.11.1"
  ]
 },
 "introduced_in": "8.8.1",
 "fixed_in": "8.11.1",
 "remediation": "Update to 8.11.1 or later.",
 "fix_released": "2026-11-08T09:47:29+00:00",
 "published": "2026-11-09T10:53:09+00:00",
 "updated": "2026-11-08T13:08:01.652838+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2757/",
  "https://plugins.svn.wordpress.org/directorist/tags/8.11.1/",
  "https://wordpress.org/plugins/directorist/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/directorist",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-11-09"
 }
}