CVE-2026-84027: medium-severity vulnerability in Directorist: AI-Powered Business Directory…
Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.3epss 0.3%
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
public PoCs found — 1
cve_referencewpscan.com/vulnerability/dff1eca0-3fdd-4e7f-8ad2-1fa52b3b4a80/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Directorist: AI-Powered Business Directory…
In the same product, most dangerous first.
CVE-2026-84026MEDIUMDirectorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users EndpointEPSS 0.3%CVE-2026-84098MEDIUMDirectorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listingEPSS 0.3%CVE-2026-77757MEDIUMDirectorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing SubmissionEPSS 0.3%CVE-2026-84046MEDIUMDirectorist < 8.9.5 - Subscriber+ SSRF via Avatar URLEPSS 0.3%CVE-2026-77766MEDIUMDirectorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders EndpointEPSS 0.3%CVE-2026-118532MEDIUMDirectorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image FieldEPSS 0.2%