critical · CVSS v3 9.1

CVE-2026-118534

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify t…

Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a subscriber, to create payment-attempt records against other users' orders.

Scores

Severity
critical
CVSS v2
4
CVSS v3
9.1
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-17329

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to improper validation of endpoint URLs.

View analysis

critical

CVE-2026-17335

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed.

View analysis

critical

CVE-2026-17336

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

View analysis

critical

CVE-2026-17338

IBM API Connect 12.1.0.0 through 12.1.1.2 suffers from broken object‑level authorization that allows a remote authenticated attacker to access sensitive data. The flaw can expose confidential configuration and user information. It is critical because it bypasses normal access controls.

View analysis