Now officially on WordPress.org

CVE Database / CVE-2026-39509

CVE · Medium

CVE-2026-39509 — Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] < 8.6.1

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2026-39509 Directorist: AI-Powered Business Directory, Listings & Classified Ads [directorist] < 8.6.1 — Medium 5.3 < 8.6.1 8.6.1 2026-02-22 —

CVE-2026-39509

A security flaw has been discovered in the Directorist plugin for WordPress, affecting versions prior to or equal to 8.5.10. The issue stems from a critical oversight: a crucial capability check is absent from a key function, allowing malicious actors to bypass authentication and execute unauthorized operations without any restrictions.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings