Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Directorist: AI-Powered Business Directory, Listings & Classified Ads | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sat, 07 Nov 2026 09:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 |
Sat, 07 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out users of other sites, including the network Super Administrator, until they re-verify their email. | |
| Title | Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-07T06:00:25.527Z
Reserved: 2026-10-28T15:31:51.417Z
Link: CVE-2026-118530
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-07T06:16:57.470
Modified: 2026-11-07T06:16:57.470
Link: CVE-2026-118530
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-07T08:45:05Z