UNKNOWNCVSS not yet scoredVulnerability
CVE-2026-118528
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above to disclose another user's private and unpublished draft listing details, including contact information.
Properties
- Last source
- NVD
- Nvd fetched at
- 2026-11-07T06:40:34.987550+00:00
- Cve id
- CVE-2026-118528
- First seen by Signal
- 2026-11-07T06:41:39+00:00
- Retrieved at
- 2026-11-07T06:41:39+00:00
- Published at
- 2026-11-07T06:16:57.233
- Last modified
- 2026-11-07T06:16:57.233
Explore deeper with Ninja Signal's threat intelligence graph