CVE-2026-77757 in Directorist Plugin
Summary
by MITRE • 08/26/2026
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in versions of The Directorist plugin prior to 8.9.3 represents a critical insecure direct object reference flaw that allows for unauthorized file manipulation on the hosting environment. This issue stems directly from insufficient input validation within the image handling routines, where user-supplied data is accepted without adequate sanitization or verification against an allowlist of permitted paths and filenames. In secure software architecture, any external input used to construct a filesystem path must be rigorously validated to ensure it does not traverse directory boundaries or reference sensitive system files. The absence of these checks enables attackers with low-privilege accounts, such as subscribers, to exploit the application logic by specifying arbitrary file paths that are readable by the web server process.
From an operational perspective, this flaw facilitates two distinct and damaging actions: unauthorized relocation and deletion of existing files. By manipulating the source parameter in a file move operation, an attacker can transfer sensitive images from protected directories into publicly accessible folders within the WordPress installation. This effectively exposes private user data or proprietary business assets to public view without authentication requirements. Furthermore, because the operation involves moving rather than copying, the original file is removed from its secure location, resulting in permanent data loss for legitimate users and potential disruption of service if critical configuration images are targeted. The ability to delete files also contributes to a denial-of-service condition by removing essential assets required for site functionality or user profiles.
This vulnerability aligns with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. It also maps closely to CWE-610, External Control of Key File Identifier, where the application allows external input to determine which file is accessed or modified without proper validation. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1530, Data from Information Repositories, as it involves accessing and exfiltrating data stored in local directories that should be restricted. The exploitation requires only subscriber-level access, highlighting a severe privilege escalation issue where low-privileged users can perform actions typically reserved for administrators or the web server user itself.
Mitigation strategies must prioritize immediate patching to version 8.9.3 or later, which addresses these input validation gaps. For environments where upgrading is not immediately feasible, temporary mitigations should include restricting file upload permissions via web server configuration and implementing strict allowlists for permitted image extensions and directory structures within the plugin settings if available. Additionally, deploying a Web Application Firewall with rules specifically tuned to detect path traversal patterns in POST or GET parameters related to media handling can provide an additional layer of defense. Regular auditing of user-generated content processing logic is essential to prevent similar insecure direct object references from being introduced during future development cycles.