{"affected":[{"defaultStatus":"unaffected","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"8.11","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118533","cwes":["CWE-639"],"description":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/a2d9ceb3-e0c8-494c-a664-5da25d1d1282/"}],"kev":null,"metrics":[],"modifiedAt":1794031225876,"publishedAt":1794031225876,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/a2d9ceb3-e0c8-494c-a664-5da25d1d1282/"}],"remediation":[],"revision":"8ff6f500cbde5be9bfbf089362f5f65a1f2f06c716b0355bc922cc28a7b0dde0","sources":[{"modifiedAt":1794031225876,"name":"CNA: WPScan","retrievedAt":1794031720923,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118533"}],"ssvc":null,"status":"published","title":"Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt","updatedAt":1794031720923}