# Directorist vulnerabilities Source: https://junglewise.ai/threats/vendors/directorist Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/directorist.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 16 vulnerabilities in Directorist: 7 in the last 7 days and 16 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-118531, was published on 12 November 2026. 7 vulnerabilities in the last four weeks, up 17% on the four before (6). 1 technology has a page of its own. ## Counts - Last 7 days: 7 - Last 30 days: 7 - Last 90 days: 16 - All time: 16 (0 critical, 0 exploited in the wild) ## Latest Directorist vulnerabilities - [CVE-2026-118531: Directorist WordPress plugin authorization bypass in listing status change](https://junglewise.ai/threats/cve-2026-118531-the-directorist-ai-powered-business-directory-listings) (info, published 12 Nov 2026) - [CVE-2026-118534: Directorist WordPress plugin access control bypass in payment retry](https://junglewise.ai/threats/cve-2026-118534-the-directorist-ai-powered-business-directory-listings) (info, published 7 Nov 2026) - [CVE-2026-118533: Directorist AI-Powered Business Directory broken access control in payment receipt](https://junglewise.ai/threats/cve-2026-118533-the-directorist-ai-powered-business-directory-listings) (info, published 7 Nov 2026) - [CVE-2026-118532: Directorist WordPress plugin arbitrary media deletion](https://junglewise.ai/threats/cve-2026-118532-the-directorist-ai-powered-business-directory-listings) (info, published 7 Nov 2026) - [CVE-2026-118530: Directorist AI-Powered Business Directory authorization bypass in bulk email verification](https://junglewise.ai/threats/cve-2026-118530-the-directorist-ai-powered-business-directory-listings) (info, published 7 Nov 2026) - [CVE-2026-118529: Directorist authorization bypass in featured listing checkout](https://junglewise.ai/threats/cve-2026-118529-the-directorist-ai-powered-business-directory-listings) (info, published 7 Nov 2026) - [CVE-2026-118528: Directorist WordPress plugin information disclosure in AJAX action](https://junglewise.ai/threats/cve-2026-118528-the-directorist-ai-powered-business-directory-listings) (info, published 7 Nov 2026) - [CVE-2026-17092: Directorist authorization bypass allows deletion of listings](https://junglewise.ai/threats/cve-2026-17092-the-directorist-ai-powered-business-directory-listings-classified) (high, CVSS 8.1, published 14 Oct 2026) - [CVE-2026-84150: Directorist authorization bypass in REST favorites endpoint](https://junglewise.ai/threats/cve-2026-84150-the-directorist-ai-powered-business-directory-listings-classified) (medium, CVSS 5.4, published 23 Sep 2026) - [CVE-2026-84098: Directorist arbitrary listing deletion in WordPress plugin](https://junglewise.ai/threats/cve-2026-84098-the-directorist-ai-powered-business-directory-listings-classified) (medium, CVSS 6.5, published 23 Sep 2026) - [CVE-2026-84046: Directorist AI-Powered Business Directory plugin SSRF in avatar URL](https://junglewise.ai/threats/cve-2026-84046-the-directorist-ai-powered-business-directory-listings-classified) (medium, CVSS 5, published 23 Sep 2026) - [CVE-2026-84027: Directorist missing authorization in REST API order creation](https://junglewise.ai/threats/cve-2026-84027-the-directorist-ai-powered-business-directory-listings-classified) (medium, CVSS 4.3, published 23 Sep 2026) - [CVE-2026-84026: Directorist AI-Powered Business Directory sensitive data disclosure via REST API](https://junglewise.ai/threats/cve-2026-84026-the-directorist-ai-powered-business-directory-listings-classified) (medium, CVSS 5.3, published 23 Sep 2026) - [CVE-2026-77766: Directorist WordPress plugin REST endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-77766-the-directorist-ai-powered-business-directory-listings-classified) (medium, CVSS 4.3, published 23 Sep 2026) - [CVE-2026-84066: Directorist Missing Authorization in Post Metadata Upload](https://junglewise.ai/threats/cve-2026-84066-directorist-missing-authorization-in-post-metadata-upload) (low, CVSS 3.1, published 4 Sep 2026) - [CVE-2026-77757: Directorist arbitrary image move via path traversal](https://junglewise.ai/threats/cve-2026-77757-directorist-arbitrary-image-move-via-path-traversal) (medium, CVSS 5.4, published 26 Aug 2026) ## Most severe Directorist vulnerabilities - [CVE-2026-17092: Directorist authorization bypass allows deletion of listings](https://junglewise.ai/threats/cve-2026-17092-the-directorist-ai-powered-business-directory-listings-classified) (high, CVSS 8.1, published 14 Oct 2026) - [CVE-2026-84098: Directorist arbitrary listing deletion in WordPress plugin](https://junglewise.ai/threats/cve-2026-84098-the-directorist-ai-powered-business-directory-listings-classified) (medium, CVSS 6.5, published 23 Sep 2026) - [CVE-2026-77757: Directorist arbitrary image move via path traversal](https://junglewise.ai/threats/cve-2026-77757-directorist-arbitrary-image-move-via-path-traversal) (medium, CVSS 5.4, published 26 Aug 2026) - [CVE-2026-84150: Directorist authorization bypass in REST favorites endpoint](https://junglewise.ai/threats/cve-2026-84150-the-directorist-ai-powered-business-directory-listings-classified) (medium, CVSS 5.4, published 23 Sep 2026) - [CVE-2026-84026: Directorist AI-Powered Business Directory sensitive data disclosure via REST API](https://junglewise.ai/threats/cve-2026-84026-the-directorist-ai-powered-business-directory-listings-classified) (medium, CVSS 5.3, published 23 Sep 2026) - [CVE-2026-84046: Directorist AI-Powered Business Directory plugin SSRF in avatar URL](https://junglewise.ai/threats/cve-2026-84046-the-directorist-ai-powered-business-directory-listings-classified) (medium, CVSS 5, published 23 Sep 2026) - [CVE-2026-77766: Directorist WordPress plugin REST endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-77766-the-directorist-ai-powered-business-directory-listings-classified) (medium, CVSS 4.3, published 23 Sep 2026) - [CVE-2026-84027: Directorist missing authorization in REST API order creation](https://junglewise.ai/threats/cve-2026-84027-the-directorist-ai-powered-business-directory-listings-classified) (medium, CVSS 4.3, published 23 Sep 2026) - [CVE-2026-84066: Directorist Missing Authorization in Post Metadata Upload](https://junglewise.ai/threats/cve-2026-84066-directorist-missing-authorization-in-post-metadata-upload) (low, CVSS 3.1, published 4 Sep 2026) - [CVE-2026-118531: Directorist WordPress plugin authorization bypass in listing status change](https://junglewise.ai/threats/cve-2026-118531-the-directorist-ai-powered-business-directory-listings) (info, published 12 Nov 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up 17% on the four before (6). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 1 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 6 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 6 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Directorist technologies - [Directorist](https://junglewise.ai/threats/technologies/directorist-directorist): 14 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Directorist vulnerabilities", https://junglewise.ai/threats/vendors/directorist, 13 November 2026.