Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.9.6 - Authenticated (Subscriber+) Incorrect Authorization to Listing Moderation Bypass via Listing Renewal
- ID
- WPSEC-2026-0142
- Plugin
- Directorist: AI-Powered Business Directory, Listings & Classified Ads (directorist)
- Affected
- all versions before 8.10
- Remediation
- Update to 8.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Directorist: AI-Powered Business Directory, Listings & Classified Ads on WPSec AttackSurface
- Fix released
- Published
Description
The Directorist plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect authorization check in the handle_listing_renewal function in all versions up to, and including, 8.9.6. The renewal handler checked only that the user could edit the listing and held a valid renewal nonce. It did not check that the listing was actually eligible for renewal, meaning expired or in its renewal window, or that renewals were enabled, and a renewal set the listing straight to 'publish'. This makes it possible for authenticated attackers, with subscriber-level access and above, who hold a dashboard renewal link for one of their own listings, to publish other listings they own that are pending administrator approval or were unpublished by an administrator, bypassing listing moderation. The bypass does not apply when paid featured listings (monetization) are enabled, because the renewal is then redirected to checkout.
References
- https://wpsec.com/vuln/WPSEC-2026-0142/
- https://plugins.svn.wordpress.org/directorist/tags/8.10/
- https://wordpress.org/plugins/directorist/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS