UNKNOWN NVD

CVE-2026-118528

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the refer

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above to disclose another user's private and unpublished draft listing details, including contact information.

References

https://wpscan.com/vulnerability/c138ecf0-1d27-4250-accc-e6e7581b6e60/

Published: 2026-11-07 · Source: NVD · Feed updated: 2026-11-07

This unknown severity vulnerability was published on 2026-11-07 via NVD.

vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.