Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-105993: DT Directory Lite Addon lets anyone change its settings
CVE-2026-105993 · published 1 day ago
Summary
The DT Directory Lite Addon for WordPress does not verify who is making changes to its configuration. Because of this, anyone on the internet can alter the plugin’s settings or appearance without logging in. Update to the latest version or replace the plugin and ensure only trusted users can modify site settings.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | dt directory lite addon | <= 1.1 |
Original advisory text
DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings Update
The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
5.3
Medium
Type
CWE-862Missing Authorization
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen3 Nov 2026
Track software like this
Free during beta