CVE-2026-84046
MediumCVSS 5.0Summary
The Directorist WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side. This allows users with the subscriber role and above to make the server issue requests to internal addresses.
Risk Assessment
An attacker can use the server to scan and access internal network resources, potentially leading to data exposure or further escalation. This is a classic SSRF attack.
Recommendation
Update the Directorist plugin to version 8.9.5 or later. Additionally, restrict outbound traffic from the server and implement URL validation on the application side.
Other vulnerabilities in Directorist WordPress plugin
See all- CVE-2026-84150Medium
The Directorist WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites. This allows any authenticated user with subscriber-level access to view and alter another user's favorites.
- CVE-2026-84098Medium
The Directorist WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it. This allows authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.
Original NVD description (English source)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.