CVE-2026-84026: Directorist WordPress Information Disclosure

CVE-2026-84026 Overview

CVE-2026-84026 affects the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin in versions before 8.9.5. The plugin exposes a REST endpoint that returns user records without enforcing authentication or authorization. Unauthenticated remote attackers can query the endpoint to retrieve private contact details of registered users. The issue is classified under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can enumerate WordPress user records and harvest private contact details through an unrestricted REST endpoint, enabling downstream phishing, credential stuffing, and targeted social engineering.

Affected Products

Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin
All versions prior to 8.9.5
WordPress sites exposing the vulnerable REST endpoint over the public internet

Discovery Timeline

2026-09-23 - CVE-2026-84026 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-84026

Vulnerability Analysis

The Directorist plugin registers a REST API route that returns records for users on the WordPress site. The route lacks a permission_callback that restricts access to authenticated or privileged callers. As a result, any anonymous HTTP client can request the endpoint and receive user data in the response.

The returned payload includes private contact details associated with registered accounts. Attackers can iterate over the endpoint to build a full inventory of usernames, email addresses, and related profile fields. This information supports phishing campaigns, credential stuffing against reused passwords, and targeted account takeover attempts.

The vulnerability does not enable code execution or data modification. The impact is confined to confidentiality of user records, which is reflected in the low integrity and availability impact of the assigned CVSS metrics.

Root Cause

The root cause is a missing authorization check on a REST API route registered by the plugin. WordPress REST routes require an explicit permission_callback to gate access. When the callback returns true unconditionally or is set to __return_true, the endpoint becomes accessible to unauthenticated clients regardless of the sensitivity of the underlying data.

Attack Vector

An attacker sends an HTTP GET request to the vulnerable REST namespace on any WordPress site running a vulnerable Directorist version. No authentication, session cookies, or nonces are required. The server responds with a JSON document containing user records and private contact information. Attack complexity is low and the vector is fully network-based. Refer to the WPScan Vulnerability Report for endpoint specifics and reproduction notes.

Detection Methods for CVE-2026-84026

Indicators of Compromise

Unauthenticated GET requests to Directorist REST namespaces under /wp-json/ originating from unfamiliar IP addresses
Bursts of sequential REST API requests suggesting enumeration of user records
Outbound phishing reports referencing email addresses that only appear in the WordPress user database

Detection Strategies

Review web server access logs for requests to /wp-json/directorist/ routes without an accompanying Authorization header or valid WordPress authentication cookie
Alert on responses to Directorist REST endpoints whose bodies exceed a baseline size, which indicates bulk user data returns
Correlate REST endpoint access with subsequent login failures on the same accounts to identify credential stuffing follow-on activity

Monitoring Recommendations

Enable request-level logging on the WordPress REST API and forward logs to a centralized analytics platform
Track the installed Directorist version across all managed WordPress sites and flag any instance below 8.9.5
Monitor threat intelligence feeds and the WPScan advisory for updated exploitation indicators

How to Mitigate CVE-2026-84026

Immediate Actions Required

Upgrade the Directorist plugin to version 8.9.5 or later on every WordPress installation
Audit WordPress user accounts for exposed email addresses and notify affected users of potential phishing risk
Rotate credentials for administrative accounts whose contact details may have been enumerated

Patch Information

The vendor fixed the issue in Directorist version 8.9.5 by restricting access to the affected REST endpoint. Update through the WordPress plugin manager or by deploying the patched release from the official plugin repository. Confirm the installed version by checking the Directorist entry on the Plugins screen or by inspecting the plugin header in wp-content/plugins/directorist/directorist-base.php.

Workarounds

Block or rate-limit unauthenticated requests to /wp-json/directorist/ routes at the web application firewall until the patch is applied
Restrict access to the WordPress REST API for anonymous users via a security plugin or custom rest_authentication_errors filter
Temporarily deactivate the Directorist plugin on sites that cannot be updated immediately

bash

# Example WAF rule (ModSecurity) to block unauthenticated Directorist REST access
SecRule REQUEST_URI "@beginsWith /wp-json/directorist/" \
    "id:1008400,phase:1,deny,status:403,\
    chain,msg:'Block unauthenticated Directorist REST access (CVE-2026-84026)'"
    SecRule &REQUEST_HEADERS:Cookie "@eq 0"