CVE-2026-84150 in Directorist AI-Powered Business Directory
Summary
by MITRE • 09/23/2026
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in The Directorist WordPress plugin prior to version 8.9.5 represents a critical failure in server-side object reference validation within its REST API implementation. This flaw specifically affects the handling of user-specific data, namely saved favorite listings. In secure web application architecture, when an authenticated client requests access to or modification of resources associated with a specific user identity, the backend service must rigorously verify that the identifier provided in the request corresponds to the session context of the currently authenticated caller. The Directorist plugin fails to perform this essential authorization check before processing REST API calls related to favorite management operations. Consequently, the application relies solely on client-supplied identifiers without cross-referencing them against the permissions and identity established during the authentication phase. This architectural oversight creates a direct pathway for unauthorized data access and manipulation by any user possessing even minimal subscriber-level privileges within the WordPress environment.
From a technical perspective, this vulnerability is classified as an Insecure Direct Object Reference (IDOR), which aligns with CWE-639 in the Common Weakness Enumeration standard. The core issue lies in the lack of proper authorization checks on the server side for API endpoints that handle user-specific state data. When a subscriber-level user interacts with the plugin to view or modify favorites, they can manipulate the request parameters to target other users' accounts by simply changing the associated user identifier in the payload. Since the application does not validate whether this requested resource belongs to the authenticated session, it proceeds to execute the read or write operation on behalf of the attacker against the victim's account. This behavior effectively bypasses standard access control mechanisms that are typically enforced at higher privilege levels but should also be strictly maintained for all user roles when handling sensitive personal data such as saved preferences and favorites.
The operational impact of this vulnerability is significant regarding both confidentiality and integrity, though it does not directly compromise system availability or administrative controls. An attacker with a basic subscriber account can enumerate the identifiers of other users on the platform and subsequently retrieve their private lists of favorite business listings. This exposure violates user privacy expectations and may reveal sensitive information about user interests, locations, or commercial activities depending on the nature of the directory content. Furthermore, the ability to alter these favorites allows an attacker to deface another user's experience by removing legitimate entries or adding malicious ones, thereby undermining data integrity. While this does not grant full administrative control over the WordPress installation, it represents a serious breach of trust and can be leveraged for further social engineering attacks or targeted harassment within the community-driven aspects of the directory platform.
This vulnerability maps directly to several techniques in the MITRE ATT&CK framework, particularly those related to unauthorized access and data exfiltration by authenticated users. It aligns with T1078 Valid Accounts, as it exploits legitimate credentials that have been compromised or created for low-privilege roles. Additionally, it reflects aspects of T1530 Data from Cloud Storage Objects if the favorites are considered stored user objects, although more accurately it fits under general unauthorized access patterns where an actor accesses data belonging to another entity without proper permission checks. The exploitation requires no special privileges beyond a standard subscriber account, making it accessible to a wide range of potential adversaries who can register on public-facing WordPress sites running this plugin.
To mitigate this vulnerability and restore secure operation, administrators must immediately update the Directorist plugin to version 8.9.5 or later, where these authorization checks have been implemented by the developers. Until an upgrade is feasible, implementing a Web Application Firewall (WAF) with rules that detect anomalous REST API behavior may provide some layer of defense, though it is not a substitute for proper code-level fixes. Developers should also conduct a thorough review of all other REST endpoints within the plugin to ensure consistent enforcement of object-level authorization checks across the entire application surface area. Adhering to secure coding practices such as those outlined in OWASP guidelines for API security will help prevent similar flaws by ensuring that every request involving user-specific data is validated against the authenticated session's identity before any database operations are performed.