CVE-2026-118532

Full vulnerability record from the local CVENow database.

Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their files.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-07 06:16:57.587000

Last modified

2026-11-07 06:16:57.587000

View original CVE JSON

{
  "id": "CVE-2026-118532",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-07T06:16:57.587",
  "lastModified": "2026-11-07T06:16:57.587",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their files."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Directorist: AI-Powered Business Directory, Listings & Classified Ads",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "8.11",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/cb8a3b6c-8bbc-456d-9b31-197ae140450c/",
      "source": "[email protected]"
    }
  ]
}