CVE-2026-59518

CriticalCVSS 9.8

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

43th percentile - higher than 43% of all known CVEs

Summary

The Directorist plugin for WordPress contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 8.8.2.

Risk Assessment

An attacker can remotely execute arbitrary code or take over the WordPress site by sending crafted data.

Recommendation

Immediately update the Directorist plugin to the latest available version that fixes this vulnerability.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8.8.2.