{"affected":[{"defaultStatus":"unaffected","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"8.11","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118529","cwes":["CWE-863"],"description":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that a user owns a listing before processing a featured-listing checkout for it, allowing any authenticated user, such as a subscriber, to publish and feature another user's pending listing when the featured listing fee is set to zero.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/1fd42aa7-97d2-48e9-9935-b413fadbad2f/"}],"kev":null,"metrics":[],"modifiedAt":1794031225354,"publishedAt":1794031225354,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/1fd42aa7-97d2-48e9-9935-b413fadbad2f/"}],"remediation":[],"revision":"05a42b355e806d305b1a502184519f722ba6728ad54ac1c44a607012c12dad28","sources":[{"modifiedAt":1794031225354,"name":"CNA: WPScan","retrievedAt":1794031717630,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118529"}],"ssvc":null,"status":"published","title":"Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout","updatedAt":1794031717630}