{"affected":[{"defaultStatus":"unaffected","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"8.11","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118532","cwes":["CWE-73"],"description":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their files.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/cb8a3b6c-8bbc-456d-9b31-197ae140450c/"}],"kev":null,"metrics":[],"modifiedAt":1794031225704,"publishedAt":1794031225704,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/cb8a3b6c-8bbc-456d-9b31-197ae140450c/"}],"remediation":[],"revision":"a02a82286db69bafbce4bd23d60950ff0e6b309d8d05eafe6ff8c255a126e708","sources":[{"modifiedAt":1794031225704,"name":"CNA: WPScan","retrievedAt":1794031719828,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118532"}],"ssvc":null,"status":"published","title":"Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field","updatedAt":1794031719828}