What is the CVSS score of CVE-2026-39509?

CVE-2026-39509 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Directorist CVE-2026-39509

Q: Which versions of Directorist are affected by CVE-2026-39509?

Broken access control in wpWax Directorist WordPress plugin versions up to 8.5.10 allows unauthenticated remote attackers to modify data through incorrectly configured authorization checks.

EUVD-2026-20176 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-rjr9-fgqp-jmc9

Authentication Bypass Directorist

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:40 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

5.3 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20176

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.5.10.

AnalysisAI

Broken access control in wpWax Directorist WordPress plugin versions up to 8.5.10 allows unauthenticated remote attackers to modify data through incorrectly configured authorization checks. The vulnerability exploits missing permission validation on plugin functionality, enabling unauthorized state changes without authentication or user interaction. With EPSS at 0.02% and no public exploit code identified, real-world risk remains low despite network-accessible exploitation.

Technical ContextAI

Directorist is a WordPress directory plugin developed by wpWax that manages business listings, classifications, and user profiles. The vulnerability stems from CWE-862 (Missing Authorization), a fundamental access control flaw where the plugin fails to verify that a user has permission to perform requested actions before executing them. This likely occurs in WordPress REST API endpoints or form handlers that lack proper capability checks (such as current_user_can() verification or nonce validation), allowing the plugin to process state-modifying requests from unauthenticated sources. The affected CPE cpe:2.3:a:wpwax:directorist:*:*:*:*:*:*:*:* indicates all versions through 8.5.10 are impacted.

RemediationAI

Update the Directorist plugin to a patched version released after 8.5.10; check the official wpWax GitHub repository or WordPress.org plugin page for the latest available release. As a temporary mitigation, administrators can restrict direct access to plugin endpoints via Web Application Firewall (WAF) rules or limit REST API exposure until patching is completed. Refer to the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/directorist/vulnerability/wordpress-directorist-plugin-8-5-10-broken-access-control-vulnerability?_s_id=cve) for detailed patching instructions and follow wpWax's official security notices for confirmation of fixed versions.