CVE-2026-17092: CWE-862 Missing Authorization in wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads

CVE-2026-17092 is an authorization bypass vulnerability (CWE-862) in the Directorist WordPress plugin up to version 8.10.2.1. The plugin fails to properly check whether a user is authorized to perform deletion actions on business directory listings. Authenticated users with subscriber-level privileges or higher can exploit this flaw to delete listings owned by others, including posts in published, draft, or private states. The security tokens (nonces) intended to protect the endpoint are ineffective because they are exposed to all logged-in users via wp_localize_script, thus not constituting a true authorization barrier.

This vulnerability allows authenticated users with minimal privileges (subscriber-level and above) to delete arbitrary business directory listings, including those owned by other users and posts in various statuses. This can lead to unauthorized data modification and potential disruption of business listings on affected WordPress sites. The integrity and availability of directory data are compromised, but confidentiality is not directly impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions if possible and monitor for suspicious deletion activity. Avoid relying on the exposed nonces for authorization. Follow vendor updates closely for an official patch or temporary fix.