CVE-2026-17092

8.1High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity, availability
Weakness: CWE-862

Impact

Authenticated users with subscriber-level access or higher can delete arbitrary business directory listings, regardless of post status or ownership. They need valid login credentials to acquire the globally exposed nonces.

Root cause

The AJAX deletion handler lacks authorization checks, relying solely on nonces that are exposed to all logged-in users via wp_localize_script.

Affected systems

Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress versions up to and including 8.10.2.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Fix & remediation

Upgrade Directorist to a version higher than 8.10.2.1 when available, or deactivate the plugin immediately if patching cannot be done.

shell

$ wp plugin update directorist

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-17092