CVE-2026-17092 Details
Description
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script.
A vulnerability exists in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress, in all versions through 8.10.2.1. The issue stems from the plugin's failure to properly verify user authorization for certain actions. This flaw enables authenticated attackers with subscriber-level access or higher to delete any business directory listings, including those belonging to other users and posts in published, draft, or private status. The nonces intended to protect the endpoint do not provide a true authorization barrier, as both 'directorist_nonce' and 'atbdp_nonce_js' are accessible to all logged-in users via 'wp_localize_script'.
Users are advised to update the Directorist WordPress plugin to version 8.10.3 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Directorist | <= 8.10.2.1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |