WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin 3.1.0-8.9.4 - Subscriber+ Arbitrary Listing Deletion vulnerability

Subscriber+ Arbitrary Listing Deletion vulnerability discovered by Artus KG in WordPress Plugin Directorist versions 3.1.0-8.9.4...

CVE-2026-84098

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging...

CVE-2026-84098

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin, versions 3.1.0 through 8.9.4 , is vulnerable to arbitrary listing deletion due to improper ownership verification. Authenticated attackers with Subscriber-level access or higher can delete any listing, inc...

CVE-2026-84098 Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging...

CVE-2026-84098 Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging...