CVE-2026-39509

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

The Directorist plugin for WordPress has an authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 8.5.10.

Risk Assessment

An attacker can bypass authorization mechanisms and gain unauthorized access to functions or data, potentially leading to confidentiality and integrity breaches.

Recommendation

It is recommended to immediately update the Directorist plugin to the latest available version that fixes this vulnerability.

Original NVD description (English source)

Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.5.10.