# CVE-2026-118534: Directorist WordPress plugin access control bypass in payment retry

Source: https://junglewise.ai/threats/cve-2026-118534-the-directorist-ai-powered-business-directory-listings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-118534 · Severity: info · Published 2026-11-07

Directorist is a WordPress plugin that manages business directories and classified ads listings. The plugin fails to verify user ownership of orders in its payment retry functionality, allowing any logged-in subscriber to create payment attempts against other users' orders and manipulate their billing records.

Technologies: [Directorist](https://junglewise.ai/threats/technologies/directorist-directorist). Vendors: [Directorist](https://junglewise.ai/threats/vendors/directorist).

## Quick answers

**Is CVE-2026-118534 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118534 being exploited in the wild.

**How severe is CVE-2026-118534?** Informational severity, published 7 November 2026.

**Which products and versions are affected?** Directorist before 8.11.

**Is there a fix for CVE-2026-118534?** Yes: fixed in 8.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118534 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-118534?** Check whether you run Directorist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.11

## Technical details

An insecure direct object reference (IDOR) vulnerability exists in the checkout payment-retry REST API endpoint. Authenticated users can bypass access controls to target orders belonging to other users by manipulating request parameters. An attacker with subscriber-level access or higher can create unauthorized payment-attempt records against arbitrary orders without privilege escalation.

## Affected products

- Directorist Directorist before 8.11

## Timeline

- 2026-11-05: disclosed
- 2026-11-07: advisory

## References

- [https://wpscan.com/vulnerability/1cc11436-a4ea-4a6e-b163-f37bcd8a3bd8/](https://wpscan.com/vulnerability/1cc11436-a4ea-4a6e-b163-f37bcd8a3bd8/)

## Related threats

- [Directorist WordPress plugin authorization bypass in listing status change](https://junglewise.ai/threats/cve-2026-118531-the-directorist-ai-powered-business-directory-listings)
- [Directorist AI-Powered Business Directory broken access control in payment receipt](https://junglewise.ai/threats/cve-2026-118533-the-directorist-ai-powered-business-directory-listings)
- [Directorist WordPress plugin arbitrary media deletion](https://junglewise.ai/threats/cve-2026-118532-the-directorist-ai-powered-business-directory-listings)
- [Directorist AI-Powered Business Directory authorization bypass in bulk email verification](https://junglewise.ai/threats/cve-2026-118530-the-directorist-ai-powered-business-directory-listings)
- [Directorist authorization bypass in featured listing checkout](https://junglewise.ai/threats/cve-2026-118529-the-directorist-ai-powered-business-directory-listings)