Vulnerability record/PUBLISHED/Published Nov 12, 2026 06:00:07 UTC
CVE-2026-118531
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing moderation and publish their own pending listings.
Base score3.1/ 10
SeverityLowCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityLow
Attack vectorNetworkAV
Attack complexityHighAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactNoneC
Integrity impactLowI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 12, 2026 11:24:02 UTC
PublishedNov 12, 2026 06:00:07 UTC
ReservedOct 28, 2026 15:32:14 UTC
Credits
- vuxvinh
- WPScan