CVE-2026-84046: Directorist WordPress Plugin SSRF Vulnerability

CVE-2026-84046 Overview

CVE-2026-84046 is a Server-Side Request Forgery (SSRF) vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin. Versions before 8.9.5 fail to validate user-supplied URLs before the server fetches them. Authenticated users with the subscriber role or higher can force the WordPress server to issue HTTP requests to internal network addresses. The flaw is tracked under CWE-918 and enables reconnaissance of internal services normally unreachable from the public internet.

Critical Impact
Any authenticated subscriber can pivot the WordPress host into internal networks, probing metadata endpoints, intranet services, and localhost-bound applications.

Affected Products

Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5
WordPress sites permitting subscriber-level registration with the plugin installed
Hosting environments exposing cloud metadata endpoints (for example, 169.254.169.254) to the WordPress host

Discovery Timeline

2026-09-23 - CVE-2026-84046 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-84046

Vulnerability Analysis

The Directorist plugin exposes functionality that accepts a URL from an authenticated user and retrieves the resource server-side. The plugin does not validate the destination of the URL, so requests to private IP ranges, loopback addresses, or cloud metadata services proceed without restriction. An attacker holding a subscriber account submits a crafted URL, and the WordPress host issues the outbound request on the attacker's behalf.

The response scope classifies this as a scope-changed issue because the vulnerable component causes another component (the internal network) to be probed. Confidentiality impact is limited to disclosure of response data or reachability information rather than direct file exfiltration from the WordPress host itself.

Root Cause

The root cause is missing validation of a user-supplied URL prior to a server-side fetch, a canonical CWE-918 pattern. The plugin trusts the input parameter and passes it directly to an HTTP client without filtering schemes, resolving DNS to check for private ranges, or enforcing an allow-list of destinations.

Attack Vector

Exploitation requires network access to the WordPress site and a subscriber-level account, which is trivial to obtain on sites with open registration. The attacker triggers the vulnerable plugin endpoint with a URL pointing to an internal target. Common targets include http://127.0.0.1:port for local admin interfaces, http://169.254.169.254/ for cloud instance metadata, and RFC1918 addresses hosting intranet services. The plugin fetches the URL and may return the response content or timing signals that allow port scanning and service enumeration.

No verified public exploit code is available. See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-84046

Indicators of Compromise

Outbound HTTP requests originating from the WordPress PHP process to RFC1918 ranges, loopback, or link-local addresses such as 169.254.169.254
Unusual subscriber account creation followed by requests to Directorist plugin AJAX or REST endpoints
Web server access logs showing authenticated requests to Directorist endpoints containing URL parameters that resolve to internal hosts

Detection Strategies

Inspect PHP-FPM and web server egress traffic for connections to private address ranges initiated by the WordPress host
Correlate authenticated Directorist plugin requests with outbound connections to non-standard internal ports within short time windows
Flag Directorist versions below 8.9.5 during software inventory and vulnerability scanning

Monitoring Recommendations

Enable request logging on the WordPress plugin layer to capture all URL parameters submitted to Directorist endpoints
Monitor cloud provider metadata endpoint access from workload IPs and alert on any unexpected hits
Ingest web server, PHP, and network flow logs into a centralized data lake for correlation across authentication and outbound request activity

How to Mitigate CVE-2026-84046

Immediate Actions Required

Upgrade the Directorist plugin to version 8.9.5 or later on all WordPress sites
Audit existing subscriber accounts and disable open user registration where it is not required
Review outbound proxy and firewall logs for prior requests from the WordPress host to internal addresses

Patch Information

The vendor addressed the issue in Directorist 8.9.5 by adding validation of the user-supplied URL prior to the server-side fetch. Site operators should apply the update through the WordPress plugin manager or by deploying the updated plugin package. Consult the WPScan Vulnerability Report for the referenced fix version.

Workarounds

Restrict egress traffic from the WordPress host to block private IP ranges, loopback, and cloud metadata endpoints when the plugin must remain in service prior to patching
Disable the Directorist plugin until the update to 8.9.5 can be deployed
Enforce IMDSv2 on AWS workloads to require session tokens for metadata requests and reduce SSRF impact

bash

# Example egress restriction using iptables to block cloud metadata access from the WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT