CVE-2026-77757
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.
Risk Assessment
The organization may experience unauthorized access to image files that may contain sensitive data, and their deletion, potentially leading to confidentiality and integrity breaches. The attack requires a subscriber account but not administrative privileges.
Recommendation
It is recommended to update the Directorist plugin to version 8.9.3 or later, which includes fixes for image reference sanitization.
Other vulnerabilities in Directorist
See all- CVE-2026-59518Critical
The Directorist plugin for WordPress contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 8.8.2.
- CVE-2026-39509Medium
The Directorist plugin for WordPress has an authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 8.5.10.
Original NVD description (English source)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.