CVE-2026-118532
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 07, 2026
Vendor
unknown
Description
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify ownership of attachment IDs supplied when updating a listing's images, allowing authenticated users with Subscriber-level access and above to permanently delete arbitrary media library attachments, including those uploaded by administrators, along with their files.