Directorist
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:directorist:_ai-powered_business_directory,_listings_&_classified_ads:*:*:*:*:*:*:*:*part: a version: _ai-powered_business_directory,_listings_&_classified_ads update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Directorist (7bba375b-83eb-51fd-9e27-cdc5b8e6afe1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-84027 |
vulnerable | 2026-10-13 12:28:55.805131 |
Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.
Published: 2026-09-23T06:00:16.624Z
Updated: 2026-09-23T10:58:07.267Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84026 |
vulnerable | 2026-10-13 12:28:55.609369 |
Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.
Published: 2026-09-23T06:00:16.455Z
Updated: 2026-09-23T10:58:21.703Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84098 |
vulnerable | 2026-10-13 12:28:55.606097 |
Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users.
This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.
Published: 2026-09-23T06:00:16.972Z
Updated: 2026-09-23T10:57:36.140Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84150 |
vulnerable | 2026-10-13 12:28:55.570249 |
Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
Published: 2026-09-23T06:00:17.146Z
Updated: 2026-09-23T10:57:21.666Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84046 |
vulnerable | 2026-10-13 12:28:55.517696 |
Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.
Published: 2026-09-23T06:00:16.795Z
Updated: 2026-09-23T10:57:51.163Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-77766 |
vulnerable | 2026-10-13 12:28:29.366821 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.