CVE-2026-84098 Overview
CVE-2026-84098 is a broken access control vulnerability [CWE-863] in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin. Versions before 8.9.5 fail to verify listing ownership before deletion. Authenticated attackers with Subscriber-level access or higher can delete arbitrary listings, including those owned by other users. This flaw represents an incomplete fix of CVE-2023-1889 and CVE-2023-35052. A separate, previously unaddressed listing-deletion code path enables the same impact from at least version 3.1.0 through the current release.
Critical Impact
Any authenticated user with Subscriber privileges can delete any listing owned by any user on affected Directorist installations, resulting in loss of business directory content integrity.
Affected Products
- Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin, versions 3.1.0 through 8.9.4
- WordPress sites running Directorist with Subscriber-level registration enabled
- Multi-tenant directory sites relying on Directorist for listing ownership isolation
Discovery Timeline
- 2026-09-23 - CVE-2026-84098 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-84098
Vulnerability Analysis
The vulnerability resides in a listing-deletion code path within the Directorist plugin. The affected handler processes delete requests but omits a check that confirms the requesting user owns the target listing. Any authenticated user, including low-privilege Subscribers, can invoke the deletion action against listing identifiers that belong to other users.
The issue is classified under [CWE-863] Incorrect Authorization. The plugin performs an authentication check but not a proper authorization check tied to the resource being modified. As a result, the plugin trusts the supplied listing identifier without validating the acting user's relationship to that record.
This flaw is an incomplete remediation of CVE-2023-1889 and CVE-2023-35052. The prior patches addressed one deletion path while leaving a parallel deletion route unpatched. The unpatched route has existed since at least version 3.1.0.
Root Cause
The root cause is missing ownership validation in a listing-deletion handler. The plugin verifies the session and role of the requester but does not compare the current user identifier with the post_author of the targeted listing before invoking WordPress deletion functions.
Attack Vector
Exploitation requires an authenticated account with Subscriber privileges, which is the default role on many WordPress sites that permit open registration. The attacker submits a crafted request to the vulnerable deletion endpoint, supplying the identifier of a listing owned by another user. The plugin processes the request and removes the target listing without an authorization error.
See the WPScan Vulnerability Report for technical details on the vulnerable code path.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-84098
Indicators of Compromise
- Unexpected wp_posts deletions for post types associated with Directorist listings (at_biz_dir or similar).
- Web server logs showing POST or GET requests to Directorist AJAX or REST endpoints with listing identifiers not owned by the requesting Subscriber account.
- User reports of missing directory listings without corresponding administrator action.
- Spikes in listing deletion events originating from newly registered low-privilege accounts.
Detection Strategies
- Correlate WordPress audit logs with plugin activity to flag deletions where the actor is not the listing owner and not an administrator or editor.
- Deploy a Web Application Firewall rule that inspects Directorist deletion requests and validates the actor-to-owner relationship at the edge.
- Enable WordPress activity logging plugins to capture deleted_post hook events with actor, post ID, and post author metadata.
Monitoring Recommendations
- Monitor account creation patterns for automated Subscriber registrations followed by immediate deletion requests.
- Track HTTP requests to admin-ajax.php and Directorist REST routes for anomalous parameter patterns and high request volumes.
- Alert on database-level deletions of listing post types outside of scheduled administrative windows.
How to Mitigate CVE-2026-84098
Immediate Actions Required
- Update the Directorist plugin to version 8.9.5 or later on all WordPress installations.
- Audit existing listings and restore any that were deleted without authorization using database backups.
- Review recently registered Subscriber accounts and disable those exhibiting suspicious activity.
- Restrict open registration temporarily if the update cannot be applied immediately.
Patch Information
Directorist version 8.9.5 introduces the ownership check on the previously unprotected deletion path. Site administrators should apply the update through the WordPress plugin dashboard or via wp-cli plugin update directorist. Confirm the installed version reads 8.9.5 or higher after the update completes.
Workarounds
- Disable the Directorist plugin until the update to 8.9.5 can be deployed if listing integrity is critical.
- Set the default new user role to a value below Subscriber or disable public registration through WordPress general settings.
- Deploy a WAF rule that blocks Directorist deletion requests where the request originates from accounts that do not match the listing owner.
- Use a WordPress role management plugin to remove listing deletion capabilities from the Subscriber role.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
