CVE-2026-84027mediumCWE-862

CVE-2026-84027: fallo de gravedad media en Directorist: AI-Powered Business Directory…

Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint

Publicada el

Seguir esta CVE+ Monitorear Directorist: AI-Powered Business Directory, Listings & Classified Ads

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 4.3epss 0.3%
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Productos afectados
Unknown · Directorist: AI-Powered Business Directory, Listings & Classified Ads
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Directorist: AI-Powered Business Directory…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-84026MEDIUMDirectorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users EndpointEPSS 0.3%CVE-2026-84098MEDIUMDirectorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listingEPSS 0.3%CVE-2026-77757MEDIUMDirectorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing SubmissionEPSS 0.3%CVE-2026-84046MEDIUMDirectorist < 8.9.5 - Subscriber+ SSRF via Avatar URLEPSS 0.3%CVE-2026-77766MEDIUMDirectorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders EndpointEPSS 0.3%CVE-2026-118532MEDIUMDirectorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image FieldEPSS 0.2%