CVE-2026-39509 wpWax CVE debrief

Who should care

Users of Directorist plugin for WordPress, version 8.5.10 or earlier, should apply patches or mitigations to prevent potential security risks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and configure access control security levels for Directorist plugin.

Technical summary

The CVE-2026-39509 vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. It was published on 2026-04-08T09:16:25.080Z and last modified on 2026-07-24T21:10:00.143Z. The vulnerability is related to a Missing Authorization issue in the Directorist plugin, which could allow attackers to exploit incorrectly configured access control security levels. Affected users should review official advisories and apply patches or mitigations.

Defensive priority

Apply patches or updates to Directorist plugin version 8.5.10 or earlier to mitigate potential security risks. Review and configure access control security levels for Directorist plugin. Monitor for potential security risks and anomalies in Directorist plugin usage.

Recommended defensive actions

• Apply patches or updates to Directorist plugin version 8.5.10 or earlier.
• Review and configure access control security levels for Directorist plugin.
• Monitor for potential security risks and anomalies in Directorist plugin usage.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record was published on 2026-04-08T09:16:25.080Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Deferred. The vulnerability affects Directorist plugin for WordPress, version 8.5.10 or earlier. Users should verify their deployments and review official advisories for mitigation guidance.

Official resources