CVE-2026-84027 Overview
CVE-2026-84027 affects the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress in versions before 8.9.5. The plugin fails to verify user capabilities when handling order creation requests through its REST API. Any authenticated user with the subscriber role or higher can create paid order and payment records with arbitrary amounts. Attackers can also attribute these records to other users, corrupting order and payment data. The weakness is classified under [CWE-862] Missing Authorization.
Critical Impact
Authenticated low-privileged users can forge paid order and payment records with arbitrary amounts and assign them to any user, undermining the integrity of directory transaction data.
Affected Products
- Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin
- Versions prior to 8.9.5
- WordPress sites exposing the plugin REST API endpoints to authenticated subscribers
Discovery Timeline
- 2026-09-23 - CVE-2026-84027 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-84027
Vulnerability Analysis
The vulnerability resides in the Directorist plugin's REST API order creation route. The endpoint accepts order and payment creation requests without confirming that the caller holds the appropriate capabilities. WordPress subscribers, the lowest authenticated role, can invoke the endpoint and supply arbitrary field values. The API accepts the amount and target user identifier from the client and writes the resulting order and payment records into the database. This allows an attacker to fabricate financial records or attribute fraudulent orders to legitimate users.
Root Cause
The root cause is a missing permission_callback capability check on the plugin's REST route handler for order creation. Without a current_user_can() check against a payment or administrative capability, the handler treats any authenticated request as authorized. This is a classic instance of [CWE-862] Missing Authorization in a WordPress REST API context.
Attack Vector
An attacker first registers a subscriber account on a target site running a vulnerable Directorist release, which is permitted by default on many WordPress installations. The attacker then authenticates and issues a crafted request to the plugin's REST API order endpoint. The request body includes a chosen order amount, payment status, and a target user identifier. The server persists the record without validating the caller's role, producing a forged order attributable to the specified account. See the WPScan Vulnerability Advisory for additional technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-84027
Indicators of Compromise
- Unexpected order or payment records created by users holding the subscriber role.
- Order records with unusual or inconsistent amounts that do not match published listing prices.
- Payment entries attributed to users who have no history of purchasing or posting listings.
Detection Strategies
- Audit WordPress database tables used by Directorist for orders and payments and compare creator identity against expected purchaser accounts.
- Review web server access logs for POST requests to Directorist REST API order routes originating from low-privileged accounts.
- Correlate REST API authentication events with subsequent order creation activity to identify anomalous sequences.
Monitoring Recommendations
- Enable WordPress REST API request logging and forward events to a centralized log platform for retention and search.
- Alert on order or payment creation calls made by accounts that lack a purchase or checkout history.
- Track the Directorist plugin version across managed WordPress estates and flag any instance below 8.9.5.
How to Mitigate CVE-2026-84027
Immediate Actions Required
- Update the Directorist plugin to version 8.9.5 or later on all affected WordPress sites.
- Review recent orders and payment records for entries created by subscriber accounts and remove fraudulent records.
- Temporarily disable open user registration if the plugin cannot be updated immediately.
Patch Information
The vendor addressed the missing authorization check in Directorist version 8.9.5. Administrators should upgrade through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Advisory for the vendor fix reference.
Workarounds
- Restrict access to the WordPress REST API for unauthenticated and low-privileged users through a web application firewall rule.
- Disable new user registration under Settings, General, Membership until the plugin is patched.
- Remove or demote inactive subscriber accounts to reduce the pool of accounts that can reach the vulnerable endpoint.
# Configuration example: block REST calls to Directorist order endpoints for non-admins via WAF
# Example ModSecurity-style rule (adapt to your WAF syntax)
SecRule REQUEST_URI "@rx /wp-json/directorist/.*/(orders|payments)" \
"id:1008027,phase:2,deny,status:403,\
msg:'Block Directorist order/payment REST calls pending CVE-2026-84027 patch'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
