---
id: CVE-2026-105993
title: DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings Update
summary: >-
  The DT Directory Lite Addon WordPress plugin through 1.1 does not perform
  nonce or capability checks on its settings handlers, allowing unauthenticated
  attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's
  config…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-862
product: DT Directory Lite Addon
affected:
  - dt_directory_lite_addon <= 1.1
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-04T14:09:28.302575Z'
published: '2026-11-03'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:24.646Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105993'
references:
  - url: 'https://wpscan.com/vulnerability/7a71b710-5022-4692-aae8-f6da7ac8b664/'
tags:
  - cve.org
epss: 0.00185
epssPercentile: 0.08189
ingestedAt: '2026-11-05T21:36:00.383Z'
---

## Overview

The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options.

## Affected

- `dt_directory_lite_addon <= 1.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.