# CVE-2026-39509: wpWax Directorist missing authorization in access control

Source: https://junglewise.ai/threats/cve-2026-39509-wpwax-directorist-missing-authorization-in-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39509 · Severity: medium · CVSS 5.3 · Published 2026-04-08

wpWax Directorist, a WordPress plugin used to create business directories and classified listing sites, contains a security flaw in its access control settings. This vulnerability allows unauthorized users to bypass intended security levels, potentially leading to unauthorized modifications of directory data. While the impact is considered limited, it could allow attackers to interfere with how listings are managed or displayed on the site.

Technologies: [wpWax Directorist](https://junglewise.ai/threats/technologies/directorist). Vendors: [wpWax](https://junglewise.ai/threats/vendors/wpwax).

## Quick answers

**Is CVE-2026-39509 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39509 being exploited in the wild.

**How severe is CVE-2026-39509?** Medium severity, with a CVSS score of 5.3, published 8 April 2026.

**Which products and versions are affected?** wpWax Directorist <= 8.5.10.

**Is there a fix for CVE-2026-39509?** A patch was published on 2026-08-06: Fixed in version 8.6.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39509 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39509?** Check whether you run wpWax Directorist at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in the wpWax Directorist plugin for WordPress through version 8.5.10. The flaw resides in the plugin's failure to properly validate authorization or security levels for certain functions, allowing unauthenticated remote attackers to execute actions that should be restricted. According to the CVSS vector, the attack has low complexity and requires no user interaction, primarily impacting data integrity rather than confidentiality or availability. The issue is addressed in version 8.6.1.

## Affected products

- wpWax Directorist <= 8.5.10

## Timeline

- 2026-01-23: other: Reported by researcher johska
- 2026-02-22: advisory: Patchstack advisory published
- 2026-04-08: disclosed: CVE published to NVD
- 2026-08-06: patched: Fixed in version 8.6.1

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/directorist/vulnerability/wordpress-directorist-plugin-8-5-10-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/directorist/vulnerability/wordpress-directorist-plugin-8-5-10-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [wpWax Directorist stored cross-site scripting](https://junglewise.ai/threats/cve-2026-122661-improper-neutralization-of-input-during-web-page-generation)
- [wpWax Directorist stored cross-site scripting](https://junglewise.ai/threats/cve-2026-119497-improper-neutralization-of-input-during-web-page-generation)
- [wpWax Directorist PHP object injection](https://junglewise.ai/threats/cve-2026-59518-wpwax-directorist-php-object-injection)