Directorist < 8.11 - Admin+ Cross-Site Account Lockout via Email Verification Bulk Action

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not check that the acting user may edit each targeted user when handling an email-verification bulk action on multisite, allowing an Administrator of one site on the network to lock out users of other sites, including the network Super Administrator, until they re-verify their email.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• wpscan.com/…erability/3605c252-a176-4c4e-a794-d5e27e032c64 İstismar kodu ya da analiz

Kayıt geçmişi

1. 7 Kas 2026 21:20CVSS puanı değişti: – → 5.0
2. 7 Kas 2026 09:00Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-118534Directorist < 8.11 - Subscriber+ Payment Retry on Other Users' Orders via IDOR
• 4,3 CVE-2026-118528Directorist < 8.11 - Subscriber+ Draft Listing Contact Information Disclosure via IDOR
• 3,1 CVE-2026-118529Directorist < 8.11 - Subscriber+ Other Users' Pending Listing Publication via Featured Listing Checkout
• 6,5 CVE-2026-118532Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field
• 4,3 CVE-2026-118533Directorist < 8.11 - Subscriber+ Order and Payment Information Disclosure via Payment Receipt
• 5,4 CVE-2026-123527Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass