CVE-2026-84026

The Directorist plugin for WordPress contains a deserialization of untrusted data vulnerability allowing object injection. The issue affects versions up to and including 8.8.2.

The Directorist plugin for WordPress before version 8.9.5 does not check user capabilities when creating orders via REST API, allowing users with subscriber role and above to create paid orders and payment records with arbitrary amounts and attribute them to other users.

The Directorist plugin for WordPress before version 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to 8.9 are not affected; the endpoint was scoped correctly in 8.8.1 and the unscoped behaviour was reintroduced in 8.9.1.

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.

The Directorist plugin for WordPress has an authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 8.5.10.