CVE-2026-77766: Directorist WordPress Auth Bypass Vulnerability

CVE-2026-77766 Overview

CVE-2026-77766 is a broken access control vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before version 8.9.5. The plugin fails to scope one of its REST collection endpoints to the requesting user. Any authenticated user with a subscriber-level account can read every customer's order and payment records. The flaw is classified as an authorization issue mapped to [CWE-639]. Versions 8.8.1 through 8.9 are not affected because the endpoint was scoped correctly in 8.8.1, but the unscoped behavior was reintroduced in 8.9.1.

Critical Impact

Low-privileged subscriber accounts can enumerate order and payment records belonging to all customers through an unscoped REST API endpoint.

Affected Products

• Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions 8.9.1 through 8.9.4
• Directorist versions prior to 8.8.1
• Directorist versions 8.8.1 through 8.9 are NOT affected

Discovery Timeline

• 2026-09-23 - CVE CVE-2026-77766 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77766

Vulnerability Analysis

The vulnerability resides in a REST collection endpoint exposed by the Directorist plugin. The endpoint returns customer order and payment records but does not enforce ownership checks against the requesting user's identity. An attacker only needs a subscriber-level WordPress account, which is the lowest authenticated role and is often available through open self-registration on directory sites.

The defect is a regression. Version 8.8.1 correctly scoped the endpoint to the calling user. The scoping logic was removed or bypassed in 8.9.1, reintroducing behavior similar to earlier vulnerable releases. Version 8.9.5 restores the intended access control.

Root Cause

The root cause is missing authorization on a REST endpoint that returns per-user resources [CWE-639]. The handler retrieves order and payment collections without filtering results by the authenticated user's ID and without invoking a capability check that restricts access to the record owner or an administrator. This design flaw allows horizontal privilege escalation across customer accounts.

Attack Vector

Exploitation requires network access to the WordPress REST API and valid subscriber credentials. An attacker authenticates to the target WordPress site, obtains a nonce or application password, and issues a GET request to the affected Directorist REST collection endpoint. The server returns order and payment data for every customer instead of only records owned by the requester. No user interaction from victims is required.

See the WPScan Vulnerability Report for endpoint-level technical details.

Detection Methods for CVE-2026-77766

Indicators of Compromise

• REST API access log entries from subscriber-role accounts requesting Directorist order or payment collection endpoints.
• Unusually large REST responses returned to low-privileged users containing multiple customer identifiers or transaction IDs.
• Repeated pagination requests against the Directorist REST namespace from a single subscriber session.

Detection Strategies

• Audit WordPress access logs for requests to /wp-json/directorist/ order and payment routes originating from non-administrative users.
• Compare the requester's user ID against the customer IDs present in response payloads to identify cross-account data access.
• Alert on subscriber-role sessions that generate high volumes of authenticated REST traffic within short time windows.

Monitoring Recommendations

• Enable WordPress REST API request logging and forward events to a centralized SIEM for correlation.
• Monitor new subscriber account registrations followed shortly by REST API enumeration activity.
• Track outbound bandwidth from the WordPress host to detect bulk export of order and payment data.

How to Mitigate CVE-2026-77766

Immediate Actions Required

• Upgrade the Directorist plugin to version 8.9.5 or later on all affected WordPress sites.
• Review recent subscriber account registrations and disable accounts created by unknown or suspicious sources.
• Rotate payment-processor API keys and notify affected customers if log analysis shows unauthorized data access.

Patch Information

The vendor addressed the issue in Directorist version 8.9.5 by restoring the user-scoped authorization check on the affected REST collection endpoint. Refer to the WPScan Vulnerability Report for the disclosed fix details and version metadata.

Workarounds

• Disable open user registration in WordPress settings to prevent untrusted actors from obtaining subscriber accounts.
• Restrict access to the Directorist REST namespace using a web application firewall rule that requires administrator capabilities.
• Temporarily deactivate the Directorist plugin on sites that cannot be upgraded immediately.

# Configuration example: block subscriber access to Directorist REST endpoints via WAF or .htaccess
# Example ModSecurity rule (adjust rule ID and endpoint path to your environment)
SecRule REQUEST_URI "@beginsWith /wp-json/directorist/" \
    "id:1007701,phase:1,deny,status:403,msg:'Block Directorist REST access pending patch to 8.9.5'"