CVE-2026-84150
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Directorist WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites. This allows any authenticated user with subscriber-level access to view and alter another user's favorites.
Risk Assessment
A low-privileged user can view and modify other users' private data. This breaches data confidentiality and integrity and may lead to actions performed on behalf of others.
Recommendation
Update the Directorist plugin to version 8.9.5 or later. Ensure that REST routes verify the user's identity against the target resource.
Other vulnerabilities in Directorist WordPress plugin
See all- CVE-2026-84098Medium
The Directorist WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it. This allows authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.
- CVE-2026-84046Medium
The Directorist WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side. This allows users with the subscriber role and above to make the server issue requests to internal addresses.
- CVE-2025-12174Medium
The Directorist plugin for WordPress (versions up to and including 8.5.2) lacks capability checks on the 'directorist_prepare_listings_export_file' and 'directorist_type_slug_change' AJAX actions. An authenticated attacker with Subscriber-level access or above can export listing details and change the directorist slug.
Original NVD description (English source)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS