{"affected":[{"defaultStatus":"unaffected","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"8.11.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118531","cwes":["CWE-863"],"description":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing moderation and publish their own pending listings.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/04ba942d-59f2-4e35-9d09-877f9bdd3606/"}],"kev":null,"metrics":[],"modifiedAt":1794463207049,"publishedAt":1794463207049,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/04ba942d-59f2-4e35-9d09-877f9bdd3606/"}],"remediation":[],"revision":"a6e090d91f5f4c6f432fc8ce7f7106c27126a376e523d8b686a5242fe44189f3","sources":[{"modifiedAt":1794463207049,"name":"CNA: WPScan","retrievedAt":1794467308628,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118531"}],"ssvc":null,"status":"published","title":"Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update","updatedAt":1794467308628}