{"id":"CVE-2026-118533","aliases":["EUVD-2026-118938","GHSA-c6hc-949q-jjm9"],"status":"published","title":"Directorist \u003c 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt","description":"The Directorist: AI-Powered Business Directory, Listings \u0026 Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00197,"percentile":0.0949,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-11-07T06:00:25Z","modified":"2026-11-07T18:16:16Z","products":[{"vendor":"unknown","product":"directorist: ai-powered business directory, listings \u0026 classified ads"},{"vendor":"wpwax","product":"directorist: ai-powered business directory, listings \u0026 classified ads"}],"references":[{"url":"https://wpscan.com/vulnerability/a2d9ceb3-e0c8-494c-a664-5da25d1d1282/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118533"},{"url":"https://wpscan.com/vulnerability/a2d9ceb3-e0c8-494c-a664-5da25d1d1282"},{"url":"https://github.com/advisories/GHSA-c6hc-949q-jjm9"}],"sources":{"cve":[{"id":"CVE-2026-118533","title":"Directorist \u003c 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt","description":"The Directorist: AI-Powered Business Directory, Listings \u0026 Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.","status":"published","published":"2026-11-07T06:00:25.876Z","modified":"2026-11-07T18:16:16.013Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-07T19:35:26.456285Z"}],"euvd":[{"id":"EUVD-2026-118938","description":"The Directorist: AI-Powered Business Directory, Listings \u0026 Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.","status":"published","published":"2026-11-07T06:00:25Z","modified":"2026-11-07T18:16:16Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-07T19:10:17.704886Z"}],"ghsa":[{"id":"GHSA-c6hc-949q-jjm9","title":"The Directorist: AI-Powered Business Directory, Listings \u0026 Classified Ads WordPress plugin before...","description":"The Directorist: AI-Powered Business Directory, Listings \u0026 Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.","status":"published","published":"2026-11-07T06:31:23Z","modified":"2026-11-07T21:32:14Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-07T21:39:59.065692Z"}],"nvd":[{"id":"CVE-2026-118533","description":"The Directorist: AI-Powered Business Directory, Listings \u0026 Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other users' order and payment information, including amounts, payment method, payment status and transaction ID.","status":"published","published":"2026-11-07T06:16:57.703Z","modified":"2026-11-10T16:28:46.51Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-07T22:06:52.100138Z"}]}}