# Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.11 - Authenticated (Subscriber+) Incorrect Authorization to Listing Moderation Bypass via REST Listing Status Update

- **ID:** WPSEC-2026-2757
- **Plugin:** Directorist: AI-Powered Business Directory, Listings & Classified Ads (`directorist`), https://wordpress.org/plugins/directorist/
- **Affected versions:** from 8.8.1 before 8.11.1
- **Fixed in:** 8.11.1 (Update to 8.11.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-11-09)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/directorist
- **Fix released:** 2026-11-08
- **Published:** 2026-11-09
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2757/

## Description

The Directorist plugin for WordPress is vulnerable to unauthorized modification of data via the REST listing update-status endpoint in versions 8.8.1 up to, and including, 8.11, due to an incomplete authorization check. The endpoint lets any listing owner who holds the listing publish capability, which the plugin grants to subscribers by default, set the status to 'publish'. Only listings in the 'pending' status were blocked, and the requested status was never checked against the directory's moderation policy. This makes it possible for authenticated attackers with subscriber-level access and above to republish their own listings that an administrator has rejected, or that are expired, draft or private, without administrator approval.

## References

- https://wpsec.com/vuln/WPSEC-2026-2757/
- https://plugins.svn.wordpress.org/directorist/tags/8.11.1/
- https://wordpress.org/plugins/directorist/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2757/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.