CVE-2026-17092: Directorist Plugin Auth Bypass Vulnerability

CVE-2026-17092 Overview

CVE-2026-17092 is an authorization bypass vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress. The flaw affects all versions up to and including 8.10.2.1. The plugin fails to verify that an authenticated user is authorized to delete a given business directory listing. Attackers holding subscriber-level accounts or higher can delete arbitrary listings owned by other users, including posts in publish, draft, or private status. The nonces guarding the AJAX endpoint (directorist_nonce and atbdp_nonce_js) are exposed to every logged-in user through wp_localize_script, so they do not act as an authorization boundary. The weakness is tracked under CWE-862: Missing Authorization.

Critical Impact

Any authenticated subscriber can permanently delete business directory listings owned by other users, destroying site content and disrupting directory operations.

Affected Products

• Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress
• All versions up to and including 8.10.2.1
• WordPress sites exposing subscriber-level registration with the Directorist plugin enabled

Discovery Timeline

• 2026-10-14 - CVE-2026-17092 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-17092

Vulnerability Analysis

The vulnerability resides in the Directorist AJAX handler responsible for listing deletion. The handler validates a nonce value before performing the delete operation but does not confirm that the requesting user owns the listing or holds a role permitted to manage it. Any authenticated user who submits a valid nonce and a target listing ID triggers the deletion path. Because the plugin uses wp_localize_script to publish both directorist_nonce and atbdp_nonce_js to the browser of every logged-in user, the nonce acts only as a cross-site request forgery control, not as an authorization check. The relevant code paths are visible in class-ajax-handler.php and class-listing-db.php.

Root Cause

The deletion endpoint lacks a capability check (for example, current_user_can('delete_post', $post_id)) and does not compare the listing author to the current user. The role management logic in class-roles.php grants subscribers directory interaction rights without constraining destructive actions to owned content. This matches the [CWE-862] pattern of missing authorization on a privileged action.

Attack Vector

An attacker registers or logs in as a subscriber on a target WordPress site running Directorist. The attacker reads the exposed nonces from any front-end page rendered for authenticated users. The attacker then issues a POST request to the Directorist AJAX endpoint with a target listing ID and the valid nonce. The server deletes the listing regardless of ownership or post status. The attack requires network access and low privileges, with no user interaction.

Detection Methods for CVE-2026-17092

Indicators of Compromise

• Unexpected deletions of Directorist listing posts (at_biz_dir custom post type) attributed to subscriber accounts in the WordPress audit log.
• POST requests to admin-ajax.php with Directorist delete actions originating from low-privileged user sessions.
• Sudden drops in published directory listing counts without corresponding administrator activity.
• New subscriber account registrations followed shortly by AJAX requests referencing listing IDs the account does not own.

Detection Strategies

• Review WordPress and plugin logs for calls to Directorist AJAX delete handlers performed by non-admin, non-author users.
• Correlate wp_posts deletion events with the authenticated user ID to flag deletions where the actor is not the listing author.
• Monitor web server access logs for repeated POST requests to admin-ajax.php carrying the directorist_nonce parameter from subscriber sessions.

Monitoring Recommendations

• Enable a WordPress activity logging plugin that records post deletions with originating user, IP, and request parameters.
• Alert on bulk deletion patterns across the at_biz_dir custom post type within short time windows.
• Track newly registered subscriber accounts that immediately interact with Directorist AJAX endpoints.

How to Mitigate CVE-2026-17092

Immediate Actions Required

• Update the Directorist plugin to a version later than 8.10.2.1 as soon as the vendor publishes a fixed release.
• Audit existing WordPress user accounts and remove unused or untrusted subscriber accounts.
• Disable open user registration on sites running Directorist until the plugin is patched.
• Back up the WordPress database and the wp_posts table so deleted listings can be restored if exploitation is detected.

Patch Information

Reference the Directorist plugin changeset and the Wordfence Vulnerability Intelligence entry for remediation details. Administrators should install the vendor-supplied update that adds proper capability and ownership checks to the listing deletion handler.

Workarounds

• Restrict access to admin-ajax.php for Directorist delete actions using a Web Application Firewall (WAF) rule that requires editor-or-above roles.
• Set WordPress to require administrator approval for new user registrations, limiting the pool of accounts able to invoke the vulnerable endpoint.
• Temporarily deactivate the Directorist plugin on high-value sites until the patch is applied.
• Use a WordPress role management plugin to remove destructive capabilities from the subscriber role where feasible.