CVE-2026-84046 in Directorist AI-Powered Business Directory
Summary
by MITRE • 09/23/2026
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin prior to version 8.9.5 constitutes a critical Server-Side Request Forgery (SSRF) flaw rooted in insufficient input validation mechanisms. This security defect arises from the application's failure to rigorously sanitize and validate user-supplied URL parameters before processing them through server-side HTTP client functions. In typical web applications, when a plugin accepts URLs provided by users for features such as fetching external data or integrating with third-party services, it must enforce strict allowlists of permitted domains and protocols while rejecting internal network addresses. The absence of these controls in versions earlier than 8.9.5 allows authenticated attackers to manipulate the destination address that the server attempts to contact.
From a technical perspective, this vulnerability leverages the principle of SSRF where an attacker tricks the server into making requests on their behalf. By supplying a URL pointing to internal network resources such as localhost, private IP ranges like 192.168.x.x or 10.x.x.x, or cloud metadata endpoints commonly found at addresses like 169.254.169.254, an attacker can cause the vulnerable server to initiate connections to services that are otherwise inaccessible from the public internet. This capability is particularly dangerous because it bypasses standard network perimeter defenses since the requests originate from within the trusted internal environment of the hosting infrastructure or cloud provider. The vulnerability affects users with a subscriber role and above, meaning that even low-privilege authenticated accounts can exploit this flaw to probe internal networks.
The operational impact of this SSRF vulnerability extends beyond simple data exfiltration. Attackers can use this vector to map out the internal network topology by probing for open ports and running services on adjacent hosts or containers within a Docker swarm, Kubernetes cluster, or traditional server farm. Furthermore, if cloud metadata endpoints are accessible through these forged requests, attackers may retrieve sensitive authentication credentials, API keys, and instance configuration data that could lead to full compromise of the underlying infrastructure. In environments where internal APIs lack proper authentication mechanisms due to their assumed isolation from external access, this vulnerability provides a direct pathway for unauthorized administrative actions or data theft across multiple systems connected to the same network segment.
This flaw aligns with Common Weakness Enumeration (CWE) identifier CWE-918, which specifically addresses Server-Side Request Forgery flaws where software makes requests from the server without validating user-supplied URLs. Additionally, in terms of offensive security tactics, this vulnerability maps directly to MITRE ATT&CK technique T1571, known as Non-Standard Port or Protocol usage when combined with internal network probing, and more broadly supports reconnaissance activities under T1046 Network Service Discovery. The exploitation relies on the attacker's ability to craft specific HTTP requests that direct the server toward unintended destinations, highlighting a fundamental gap in input validation logic within the plugin’s codebase.
To mitigate this vulnerability, administrators must immediately upgrade The Directorist plugin to version 8.9.5 or later where these security controls have been implemented. If upgrading is not immediately feasible, temporary mitigations include implementing strict URL allowlisting at the application level using regular expressions that restrict allowed schemes and domains, as well as deploying web application firewalls (WAFs) configured to detect and block SSRF patterns in HTTP requests. Network-level segmentation should also be reviewed to ensure that internal services are not exposed via loopback interfaces or private IP ranges accessible from the web server’s network interface. Regular security audits focusing on input validation for any feature involving external resource fetching are essential to prevent similar vulnerabilities in future updates.