{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39509", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:47:50.137Z", "datePublished": "2026-04-08T08:30:14.240Z", "dateUpdated": "2026-04-08T08:30:14.240Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "directorist", "product": "Directorist", "vendor": "wpWax", "versions": [{"changes": [{"at": "8.6.1", "status": "unaffected"}], "lessThanOrEqual": "8.5.10", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "johska | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:29:01.869Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Directorist: from n/a through <= 8.5.10.</p>"}], "value": "Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.5.10."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:14.240Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/directorist/vulnerability/wordpress-directorist-plugin-8-5-10-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Directorist plugin <= 8.5.10 - Broken Access Control vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.5.10."}], "id": "CVE-2026-39509", "lastModified": "2026-04-08T21:26:35.910", "metrics": {}, "published": "2026-04-08T09:16:25.080", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/directorist/vulnerability/wordpress-directorist-plugin-8-5-10-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,8.5.10]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[8.6.1,8.6.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Directorist", "source": "cna", "vendor": "wpWax"}, "product": "directorist", "vendor": "wpwax"}], "analysis": {"en": {"generated_at": "2026-04-08T09:21:23.949769+00:00", "value": {"mitigation_remediation": ["Update the Directorist plugin to version 8.5.11 or later.", "Verify that access control settings are correctly configured in the plugin.", "Restrict the plugin's capabilities to only necessary user roles.", "Monitor WordPress logs for unusual access attempts or unauthorized changes."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "Vulnerable installations include any WordPress site using the Directorist plugin version 8.5.10 or earlier. The issue applies to all users who have installed this plugin without upgrading past the specified version; no additional software components are required for exploitation.", "description_and_impact": "WordPress plugin wpWax Directorist contains a missing authorization flaw in versions up to 8.5.10, which allows attackers to bypass intended security checks and access protected functions or data without proper credentials. The flaw arises from incorrectly configured access control security levels and is classified as CWE\u2011862.", "risk_and_exploitability": "The exploitation requires interaction with the plugin's administrative endpoints, typically via an authenticated session or by manipulating request parameters when security levels are misconfigured. Based on the description, it is inferred that the attacker would need to target specific HTTP requests to the plugin's endpoints. Although CVSS and EPSS metrics are not reported here, missing authorization normally leads to high severity, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting that exploitation is possible but may not yet be widely observed."}}}}, "created": "2026-04-08T19:30:33.431780+00:00", "updated": "2026-04-08T19:42:59.550246+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpwax", "wpwax$PRODUCT$directorist"]}