WordPress Plugin Vulnerabilities

Directorist < 8.9.5 - Subscriber+ SSRF via Avatar URL

Description

The plugin does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.

Proof of Concept

Affects Plugins

Plugin icon
directorist
Fixed in 8.9.5

References

CVE
CVE-2026-84046

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.0 (medium)

Miscellaneous

Original Researcher
Bhaveshkumar Parmar
Submitter
Bhaveshkumar Parmar
Verified
Yes
WPVDB ID
a5279c4b-ce91-4322-b5c3-70cd1d6d3ba8

Timeline

Publicly Published
2026-09-21 (about 2 days ago)
Added
2026-09-21 (about 1 day ago)
Last Updated
2026-09-21 (about 1 day ago)

Other

Published
Title
Published
2025-01-24
Title
Comment Edit Core – Simple Comment Editing < 3.1.0 - Authenticated (Admin+) Server-Side Request Forgery
Published
2025-02-24
Title
Enfold < 7.0 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id
Published
2026-09-03
Title
Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint
Published
2025-06-19
Title
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor < 1.27.9 - Authenticated (Contributor+) Server-Side Request Forgery
Published
2026-03-20
Title
MimeTypes Link Icons < 3.3.0 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content