PT-2026-81967 · WordPress · Directorist
CVE-2026-77757
·
Published
2026-08-26
·
Updated
2026-08-26
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions 8.5 through 8.9.2
Description
Insufficient sanitization of a user-supplied image reference occurs before it is used as the source of a file move. This allows users with subscriber-level accounts to relocate arbitrary server-readable image files into a publicly accessible directory and delete them from their original location via the REST v2 Listing Submission endpoint.
Recommendations
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin to version 8.9.3 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Directorist