CVE-2026-84066 in Directorist AI-Powered Business Directory
Summary
by MITRE • 09/04/2026
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in versions of The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin prior to version 8.9 represents a critical failure in access control logic regarding file handling operations. This flaw specifically affects the mechanism used to update metadata for uploaded images associated with business listings or classified ads. In a secure application architecture, any operation that modifies data belonging to another entity must strictly verify that the initiating request originates from an authorized owner of that specific resource. However, this plugin fails to implement such verification checks before processing file uploads and updating their corresponding database records. Consequently, the system blindly accepts metadata updates for image files based solely on the presence of a valid session or authentication token associated with any logged-in user, rather than validating ownership of the target post ID being modified.
From a technical perspective, this deficiency allows attackers to perform unauthorized writes to file metadata fields that are typically used by WordPress themes and plugins to display images in directory listings. By exploiting this lack of object-level authorization checks, an attacker can manipulate the image references stored in the database for posts created by other users. This is particularly dangerous because it does not require high-privilege administrative access; instead, it can be executed by any user with a subscriber role or higher, which includes most registered members on public-facing WordPress sites. The attack vector typically involves crafting specific HTTP requests that target the metadata update endpoints while supplying parameters for an image file belonging to a different user account.
The operational impact of this vulnerability extends beyond simple data corruption. By overwriting the image metadata references, an attacker can effectively hijack the visual representation of another user's business listing or classified ad. This capability enables several malicious outcomes, including defacement where inappropriate images are displayed in place of legitimate ones, which severely damages the reputation and credibility of the affected business owners. Furthermore, if the overwritten metadata points to a maliciously crafted image file hosted on an attacker-controlled server, it could facilitate cross-site scripting attacks or drive-by downloads when other users view the compromised listing. This undermines user trust in the platform's integrity and exposes site administrators to liability regarding content moderation failures.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting the failure to verify ownership before performing state-changing operations on resources owned by others. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, as it leverages legitimate user credentials to perform unauthorized actions due to insufficient authorization checks within the application logic rather than a flaw in authentication itself. The severity is heightened because subscriber-level accounts are often abundant on directory sites, providing numerous potential entry points for exploitation without requiring complex privilege escalation steps.
To mitigate this risk, site administrators must immediately update The Directorist plugin to version 8.9 or later, where the developers have implemented proper ownership verification checks before allowing metadata updates. Until an upgrade is possible, implementing a Web Application Firewall with rules that restrict direct access to sensitive AJAX endpoints related to file uploads can provide temporary protection. Additionally, enforcing strict role-based permissions through additional security plugins may help limit the exposure of these specific functions to only those users who genuinely require them for legitimate administrative tasks. Regular auditing of plugin code and adherence to secure coding standards that mandate explicit ownership validation are essential practices to prevent similar access control bypasses in future updates or other software components.