CVE-2026-118531— Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update
Quick assessment
Affected
Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Directorist: AI 驱动的商业目录、列表与分类广告 WordPress 插件在 8.11.1 版本之前，未阻止列表的创建者自行将其状态从“待审核”更改为“已发布”。这使得拥有订阅者（Subscriber）级别或更高权限的用户能够绕过管理员的列表审核机制，自行发布其处于待审核状态的列表。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1548.001 · Setuid and Setgid
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-118531
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update
Source: CVE Program / CVE List V5
Vulnerability Description
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing moderation and publish their own pending listings.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 0 ~ 8.11.1 | - |
|
II. Public POCs for CVE-2026-118531
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-118531
请登录查看更多情报信息。
Other References for CVE-2026-118531 (1)
-
https://wpscan.com/vulnerability/04ba942d-59f2-4e35-9d09-877f9bdd3606/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-11-12 · 21 CVEs total
| CVE-2026-121498 | Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR | |
| CVE-2026-110072 | Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attr | |
| CVE-2026-110041 | Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST E | |
| CVE-2026-106027 | Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion v | |
| CVE-2026-110959 | Descope < 1.2.0 - Unauthenticated Account Takeover | |
| CVE-2026-119039 | Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detecti | |
| CVE-2026-118421 | WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter | |
| CVE-2026-123044 | ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure | |
| CVE-2026-119040 | Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification | |
| CVE-2026-122003 | Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF | |
| CVE-2026-76792 | User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP L | |
| CVE-2026-123092 | WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Actio | |
| CVE-2026-124652 | Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR | |
| CVE-2026-124653 | Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure | |
| CVE-2026-124647 | TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie | |
| CVE-2026-124648 | TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key | |
| CVE-2026-124815 | Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions | |
| CVE-2026-124814 | Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 't | |
| CVE-2026-124817 | Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification | |
| CVE-2026-124665 | Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure v |
IV. Related Vulnerabilities
-
CVE-2026-118534
Directorist < 8.11 - Subscriber+ Payment Retry on Other User -
CVE-2026-118530
Directorist < 8.11 - Admin+ Cross-Site Account Lockout via E -
CVE-2026-118532
Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion vi -
CVE-2026-118533
Directorist < 8.11 - Subscriber+ Order and Payment Informati -
CVE-2026-118528
Directorist < 8.11 - Subscriber+ Draft Listing Contact Infor
Same vendor: Unknown
-
CVE-2026-76792
User Verification 2.0.38 - 2.0.48 - Unauthenticated Account -
CVE-2026-124665
Order Tracking < 3.6.2 - Unauthenticated Customer and Sales -
CVE-2026-124817
Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modi -
CVE-2026-124814
Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticate -
CVE-2026-124815
Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record D