CVE-2026-84150 Overview
CVE-2026-84150 is an Insecure Direct Object Reference (IDOR) vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin. Versions before 8.9.5 fail to verify that the target user of a REST route matches the authenticated caller. Any authenticated user with subscriber-level access can read and modify another user's saved favorites. The flaw maps to CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Subscriber-level attackers can enumerate and tamper with the saved favorites of any other Directorist user, breaking per-user data isolation.
Affected Products
- Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin, all versions before 8.9.5
- WordPress sites exposing the plugin's favorites REST endpoints to authenticated subscribers
- Multi-user directory deployments relying on Directorist for per-user favorites
Discovery Timeline
- 2026-09-23 - CVE-2026-84150 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-84150
Vulnerability Analysis
The Directorist plugin exposes REST routes that read and write a user's saved favorite listings. These routes accept a user identifier as a parameter and operate on the corresponding user record. The plugin does not confirm that the identifier in the request matches the identifier of the currently authenticated caller.
As a result, an authenticated user can substitute another account's identifier and interact with that account's favorites. The action requires only subscriber-level privileges, which are commonly granted through open registration on directory sites. The impact is limited to the favorites data store, but it breaks the tenancy boundary between user accounts.
This is a textbook Insecure Direct Object Reference issue. The REST controller trusts a client-supplied key rather than deriving the target from the authenticated session context.
Root Cause
The root cause is a missing authorization check between the authenticated user and the user_id parameter used by the favorites REST controller. Authentication (is_user_logged_in) is enforced, but authorization ("does this session own the target record?") is not. Fixing the class of bug requires deriving the operating user from get_current_user_id() or comparing it to any supplied identifier before proceeding.
Attack Vector
Exploitation requires network access to the WordPress REST API and valid subscriber credentials. The attacker sends an authenticated HTTP request to the plugin's favorites route, replacing the target user identifier with that of another account. The server returns or modifies the victim's favorites without further checks. No user interaction is required from the victim. See the WPScan Vulnerability Report for endpoint specifics.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-84150
Indicators of Compromise
- Authenticated REST requests to Directorist favorites endpoints where the user_id parameter does not match the session's authenticated user identifier.
- Bursts of GET or POST requests from a single subscriber account iterating sequential user_id values.
- Unexpected changes in the favourites user meta for accounts that did not initiate the change.
Detection Strategies
- Enable REST API request logging and correlate the authenticated user with any user_id path or query parameter in Directorist routes.
- Alert when a single authenticated session accesses favorites for more than one distinct target user in a short window.
- Review WordPress audit logs for user meta updates on the favourites key attributed to sessions other than the record owner.
Monitoring Recommendations
- Ingest WordPress and web server access logs into a centralized analytics platform and normalize the authenticated user identifier alongside REST parameters.
- Track the Directorist plugin version across all WordPress hosts and flag any instance below 8.9.5.
- Monitor subscriber account creation rates on public-facing directory sites, since low-privilege accounts are the prerequisite for exploitation.
How to Mitigate CVE-2026-84150
Immediate Actions Required
- Upgrade the Directorist plugin to version 8.9.5 or later on all WordPress installations.
- Audit subscriber accounts for suspicious registration patterns and recent activity against favorites endpoints.
- Review and, where feasible, reset user favorites data if tampering is suspected.
Patch Information
The vendor addressed CVE-2026-84150 in Directorist version 8.9.5. The fix enforces that the authenticated caller matches the target user before the favorites REST route reads or writes data. Details are tracked in the WPScan Vulnerability Report.
Workarounds
- Disable the Directorist plugin until the site can be upgraded to 8.9.5.
- Restrict subscriber registration on directory sites that do not require it, reducing the pool of accounts able to reach the vulnerable route.
- Use a Web Application Firewall rule to block requests to Directorist favorites REST paths where the request user_id does not match the authenticated session.
# Configuration example: verify the installed Directorist version via WP-CLI
wp plugin get directorist --field=version
wp plugin update directorist --version=8.9.5
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
