CVE-2026-84066lowCWE-862

CVE-2026-84066: falha de baixa gravidade em Directorist: AI-Powered Business Directory…

Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload

Publicada em

Seguir esta CVE+ Monitorar Directorist: AI-Powered Business Directory, Listings & Classified Ads

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 3.1epss 0.2%
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Unknown · Directorist: AI-Powered Business Directory, Listings & Classified Ads
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Directorist: AI-Powered Business Directory…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-84026MEDIUMDirectorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users EndpointEPSS 0.3%CVE-2026-84098MEDIUMDirectorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listingEPSS 0.3%CVE-2026-77757MEDIUMDirectorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing SubmissionEPSS 0.3%CVE-2026-84046MEDIUMDirectorist < 8.9.5 - Subscriber+ SSRF via Avatar URLEPSS 0.3%CVE-2026-77766MEDIUMDirectorist 8.5 - 8.9.4 - Subscriber+ Order and Financial Record Disclosure via REST Orders EndpointEPSS 0.3%CVE-2026-84027MEDIUMDirectorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders EndpointEPSS 0.3%