CVE-2026-84098
MediumCVSS 6.5Summary
The Directorist WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it. This allows authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.
Risk Assessment
A low-privileged user can delete arbitrary listings, including those belonging to others, causing data loss and service disruption. The issue affects many versions and can be exploited at scale.
Recommendation
Update the Directorist plugin to version 8.9.5 or later. Verify that all listing-deletion paths check ownership, and review backups for lost data.
Other vulnerabilities in Directorist WordPress plugin
See all- CVE-2026-84150Medium
The Directorist WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites. This allows any authenticated user with subscriber-level access to view and alter another user's favorites.
- CVE-2026-84046Medium
The Directorist WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side. This allows users with the subscriber role and above to make the server issue requests to internal addresses.
Original NVD description (English source)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.