{"affected":[{"defaultStatus":"unaffected","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"8.11","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118530","cwes":["CWE-863"],"description":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out users of other sites, including the network Super Administrator, until they re-verify their email.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/3605c252-a176-4c4e-a794-d5e27e032c64/"}],"kev":null,"metrics":[],"modifiedAt":1794031225527,"publishedAt":1794031225527,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/3605c252-a176-4c4e-a794-d5e27e032c64/"}],"remediation":[],"revision":"ffc050c93d797e92bdb47383dab9ecad623fcce2d4f3d8cd8a8c604e1b7204c0","sources":[{"modifiedAt":1794031225527,"name":"CNA: WPScan","retrievedAt":1794031718725,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118530"}],"ssvc":null,"status":"published","title":"Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action","updatedAt":1794031718725}