CVE-2026-59518 Overview
CVE-2026-59518 is a PHP Object Injection vulnerability in the wpWax Directorist plugin for WordPress. The flaw stems from deserialization of untrusted data [CWE-502] and affects all versions of Directorist up to and including 8.8.2. An unauthenticated attacker can send crafted serialized payloads over the network to trigger object instantiation within the plugin. When combined with a suitable POP (Property-Oriented Programming) gadget chain present in WordPress core, other plugins, or themes, the vulnerability can lead to arbitrary code execution, file operations, or data compromise.
Critical Impact
Unauthenticated network attackers can inject arbitrary PHP objects into vulnerable Directorist installations, potentially achieving full site compromise when exploitable gadget chains are present.
Affected Products
- wpWax Directorist plugin for WordPress
- All versions from n/a through 8.8.2
- WordPress sites running the Directorist business directory plugin
Discovery Timeline
- 2026-07-13 - CVE-2026-59518 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-59518
Vulnerability Analysis
The Directorist plugin passes attacker-controlled input into a PHP deserialization sink such as unserialize() without prior validation or restriction of allowed classes. PHP deserialization instantiates arbitrary objects and invokes magic methods including __wakeup(), __destruct(), and __toString(). These methods can execute unintended logic depending on the classes available at runtime.
Because WordPress environments load many plugins and themes, an attacker can chain together property-oriented programming (POP) gadgets from the wider PHP class ecosystem. The result ranges from arbitrary file read and write to remote code execution, SQL query manipulation, and privilege escalation.
Root Cause
The root cause is unsafe deserialization of user-controlled data [CWE-502]. Directorist accepts serialized input from an untrusted source and processes it through PHP's native deserialization functions. No allowlist of expected class types is enforced, and no cryptographic integrity check validates that the serialized blob originated from the application.
Attack Vector
Exploitation requires no authentication and no user interaction. The attacker sends a specially crafted HTTP request to a Directorist endpoint that accepts serialized data, such as a form submission, AJAX action, or REST route. The payload contains a serialized PHP object graph designed to trigger a gadget chain during deserialization. Successful exploitation executes attacker-chosen logic in the context of the PHP-FPM or web server user.
Refer to the Patchstack Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-59518
Indicators of Compromise
- HTTP requests to Directorist endpoints containing serialized PHP patterns such as O:, a:, or s: followed by numeric length markers in request bodies or parameters.
- Unexpected outbound network connections from the web server process immediately after suspicious POST requests to Directorist AJAX or REST routes.
- New or modified PHP files in wp-content/uploads/ or plugin directories following anomalous Directorist traffic.
- Creation of unexpected administrator accounts or modification of wp_options entries such as active_plugins or siteurl.
Detection Strategies
- Inspect web server access logs for POST requests targeting Directorist endpoints with body content matching serialized PHP object signatures.
- Deploy Web Application Firewall (WAF) rules that flag serialized payloads containing class names in HTTP parameters not expected to hold serialized data.
- Monitor PHP error logs for __wakeup(), __destruct(), and unserialize() warnings referencing unknown or unexpected classes.
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress installation, particularly wp-content/plugins/directorist/ and the uploads directory.
- Alert on WordPress option changes, new admin user creation, and modifications to core files.
- Correlate WAF alerts with endpoint telemetry to identify post-exploitation activity such as webshell drops or reverse shell processes.
How to Mitigate CVE-2026-59518
Immediate Actions Required
- Update Directorist to the latest patched release above version 8.8.2 as soon as the vendor publishes a fix.
- Restrict access to WordPress admin and Directorist endpoints using IP allowlists or authentication proxies where feasible.
- Audit WordPress installations for signs of prior exploitation, including unexpected admin users, unknown plugins, and modified core files.
Patch Information
Refer to the Patchstack Vulnerability Report for the current patched version and vendor advisory. Apply the vendor-supplied update through the WordPress plugin manager or via WP-CLI. Verify the installed version reports higher than 8.8.2 after update.
Workarounds
- Deactivate and remove the Directorist plugin until a patched version is installed if the plugin is not business-critical.
- Deploy WAF rules that block requests containing serialized PHP object signatures (O:\d+:", a:\d+:{) in fields that should not carry serialized data.
- Restrict PHP class autoloading and remove unused plugins to reduce the available gadget surface for POP chain construction.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
