CVE-2026-77757 Overview
CVE-2026-77757 affects the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin in versions before 8.9.3. The plugin fails to sanitize a user-supplied image reference before using it as the source path of a file move operation. Authenticated users with only subscriber-level privileges can abuse this flaw to relocate arbitrary server-readable image files into a publicly accessible directory. The same operation deletes the files from their original location. The issue is classified as a path traversal weakness [CWE-22].
Critical Impact
Low-privileged subscribers can move and delete arbitrary server-readable image files, exposing internal assets and disrupting site integrity.
Affected Products
- Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.3
- WordPress sites permitting subscriber-level account registration with Directorist enabled
- Any WordPress deployment shipping Directorist as a bundled component below 8.9.3
Discovery Timeline
- 2026-08-26 - CVE-2026-77757 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-77757
Vulnerability Analysis
The vulnerability resides in a Directorist workflow that accepts an image reference from an authenticated request. The plugin uses that reference as the source argument to a file move operation without validating that the target path stays within an allowed image directory. Because subscribers can trigger this workflow, any account created through open registration can invoke the affected code path.
Exploitation shifts a file the web server can read into a publicly reachable directory served by the site. The move also removes the file from its original location, producing a secondary integrity impact. Attackers can chain the primitive to expose configuration files, backups, or internal assets that were previously outside the web root.
Root Cause
The root cause is missing input sanitization on a user-controlled path parameter. The plugin trusts the supplied image reference and passes it directly into a filesystem move call. No path canonicalization, allowlist check, or containment validation restricts the source to legitimate image storage. This is a textbook path traversal weakness under [CWE-22].
Attack Vector
The attack vector is network-based and requires a valid subscriber account. The attacker submits a crafted request containing a traversal sequence or absolute path in place of a legitimate image identifier. The plugin resolves the reference on the server and moves the referenced file into a publicly accessible location. No user interaction is required beyond the attacker's own request.
Verified proof-of-concept code is not published in the referenced advisory. Technical detail is available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-77757
Indicators of Compromise
- Unexpected files appearing under Directorist upload directories, particularly non-image types or files with paths resembling system locations.
- Missing files in application, backup, or configuration directories that the web server user has read access to.
- Authenticated POST requests from subscriber accounts to Directorist listing or image-handling endpoints containing ../ sequences or absolute paths.
Detection Strategies
- Inspect web server access logs for subscriber-authenticated requests to Directorist endpoints referencing image parameters with directory traversal patterns.
- Compare filesystem inventories against baselines to identify files that have been relocated out of protected directories.
- Alert on new file creations in publicly served upload paths whose extensions or magic bytes do not match image formats.
Monitoring Recommendations
- Enable WordPress audit logging to capture subscriber activity against Directorist endpoints.
- Monitor filesystem changes under wp-content/uploads and Directorist-managed directories with an integrity monitoring tool.
- Track newly registered subscriber accounts followed by immediate access to plugin image workflows.
How to Mitigate CVE-2026-77757
Immediate Actions Required
- Update the Directorist plugin to version 8.9.3 or later on every WordPress site where it is installed.
- Audit subscriber accounts, remove unknown or dormant registrations, and disable open registration where it is not required.
- Review Directorist upload directories for files that do not belong and restore any files moved out of protected locations.
Patch Information
The vendor addresses the issue in Directorist 8.9.3. The fix introduces validation of the user-supplied image reference before it is used as the source of the file move operation. Refer to the WPScan Vulnerability Report for advisory details and remediation guidance.
Workarounds
- Restrict subscriber-level registration until the plugin is upgraded to 8.9.3.
- Apply a Web Application Firewall rule to block requests to Directorist image endpoints that contain ../, null bytes, or absolute filesystem paths in image parameters.
- Tighten filesystem permissions so the web server account cannot read sensitive files outside required application directories.
# Configuration example: WAF rule sketch to block traversal in Directorist image parameters
# Deny requests where image reference parameters contain traversal or absolute paths
SecRule ARGS_NAMES "@rx (?i)(image|img|file|attachment)" \
"chain,deny,status:403,id:1077757,msg:'Directorist path traversal attempt (CVE-2026-77757)'"
SecRule ARGS "@rx (\.\./|\.\.\\|^/|\\x00)" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
