CVE-2026-84150
MediumCVSS 5.4Summary
The Directorist WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites. This allows any authenticated user with subscriber-level access to view and alter another user's favorites.
Risk Assessment
A low-privileged user can view and modify other users' private data. This breaches data confidentiality and integrity and may lead to actions performed on behalf of others.
Recommendation
Update the Directorist plugin to version 8.9.5 or later. Ensure that REST routes verify the user's identity against the target resource.
Other vulnerabilities in Directorist WordPress plugin
See all- CVE-2026-84098Medium
The Directorist WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it. This allows authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.
- CVE-2026-84046Medium
The Directorist WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side. This allows users with the subscriber role and above to make the server issue requests to internal addresses.
Original NVD description (English source)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.