CVE-2026-39509
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Directorist plugin for WordPress has an authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 8.5.10.
Risk Assessment
An attacker can bypass authorization mechanisms and gain unauthorized access to functions or data, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to immediately update the Directorist plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Directorist
See all- CVE-2026-59518Critical
The Directorist plugin for WordPress contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 8.8.2.
- CVE-2026-84066Low
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.
- CVE-2026-77757Medium
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.
Original NVD description (English source)
Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.5.10.