Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.9.5 - Authenticated (Subscriber+) Missing Authorization to Review Moderation
- ID
- WPSEC-2026-0210
- Plugin
- Directorist: AI-Powered Business Directory, Listings & Classified Ads (directorist)
- Affected
- from 7.1.0 before 8.9.6
- Remediation
- Update to 8.9.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Directorist: AI-Powered Business Directory, Listings & Classified Ads on WPSec AttackSurface
- Fix released
- Published
Description
The Directorist plugin for WordPress is vulnerable to unauthorized review moderation and reviewer data exposure in all versions up to, and including, 8.9.5 due to incorrect capability mapping for the edit_comment capability on listing reviews. WordPress maps edit_comment to edit_post on the parent listing, a capability Directorist grants Subscribers for their own listings, and the plugin's map_meta_cap_for_review_author filter additionally granted review authors edit_comment; neither path required moderate_comments. This makes it possible for authenticated attackers with Subscriber-level access and above who own a directory listing to approve, unapprove, spam, trash or rewrite other users' reviews and star ratings on that listing, through the plugin's front-end review edit form and the core comment moderation screens, and to view reviewers' email addresses on the comment edit screen. Review authors could also approve their own reviews that were held for moderation. When owner review notifications were enabled, the notification email also disclosed the reviewer's email address.
References
- https://wpsec.com/vuln/WPSEC-2026-0210/
- https://plugins.svn.wordpress.org/directorist/tags/8.9.6/
- https://wordpress.org/plugins/directorist/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS