Unrated severityNVD Advisory· Published Nov 7, 2026

CVE-2026-118528

Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above to disclose another user's private and unpublished draft listing details, including contact information.

Affected products

WordPress/Directorist: AI-Powered Business Directory Plugin with Classified Ads Listingsllm-fuzzy
Range: <8.11

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/c138ecf0-1d27-4250-accc-e6e7581b6e60/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000