WordPress Plugin Vulnerabilities

Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint

Description

The plugin does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.

Proof of Concept

Affects Plugins

Plugin icon
directorist
Fixed in 8.9.5

References

CVE
CVE-2026-84026

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Usama Arshad
Submitter
Usama Arshad
Submitter website
https://www.usamaarshad.me/
Submitter twitter
usama0x01
Verified
Yes
WPVDB ID
4311f66d-f032-4753-88e8-2afbd5d73ebc

Timeline

Publicly Published
2026-09-21 (about 2 days ago)
Added
2026-09-21 (about 1 day ago)
Last Updated
2026-09-21 (about 1 day ago)

Other

Published
Title
Published
2024-07-11
Title
HitPay Payment Gateway for WooCommerce < 4.1.4 - Information Exposure via Log Files
Published
2026-09-14
Title
FluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR
Published
2026-05-19
Title
Slider Revolution < 7.0.10 - Unauthenticated Sensitive Information Exposure via 'sliders/stream'
Published
2024-09-11
Title
Migration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure
Published
2025-04-15
Title
WP Staging Pro < 6.1.3 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function