CVE-2026-84026

Overview

The Directorist WordPress plugin (versions prior to 8.9.5) exposes a REST endpoint that returns user records without authentication. This flaw allows attackers to retrieve private contact details of all registered users. The vulnerability is medium severity with a low EPSS score, indicating limited but still relevant risk.

Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.

Impact

Confidentiality is compromised as attackers can view private user contact information. Integrity is not directly affected, but the data exposure could be leveraged for social engineering. Availability remains intact. Defenders should treat exposed user data as a breach risk and enforce least privilege on REST endpoints.

Remediation

Update the Directorist plugin to version 8.9.5 or later, which restricts the REST endpoint to authenticated users only. If an update is not immediately possible, add a custom rule in the WordPress REST API to require authentication for the /directorist/v1/users endpoint. Additionally, review and tighten user role capabilities, and monitor REST API logs for suspicious activity.

Risk context

The CVSS v3 score of 5.3 classifies this as medium risk, and the EPSS of 0.00199 suggests a low probability of exploitation in the wild. Nonetheless, the exposure of private user data warrants prompt remediation, especially for sites with sensitive user information.

Affected products

• Directorist 8.9.4
• Directorist 8.9.3
• Directorist 8.9.2
• Directorist 8.9.1
• Directorist 8.9.0
• Directorist 8.8.9
• Directorist 8.8.8
• Directorist 8.8.7