WordPress Plugin Vulnerabilities

Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint

Description

The plugin does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.

Proof of Concept

Affects Plugins

Plugin icon
directorist
Fixed in 8.9.5

References

CVE
CVE-2026-84027

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
LevinityCyber
Submitter
LevinityCyber
Submitter website
https://levinitycyber.com
Submitter twitter
levinitycyber
Verified
Yes
WPVDB ID
dff1eca0-3fdd-4e7f-8ad2-1fa52b3b4a80

Timeline

Publicly Published
2026-09-21 (about 2 days ago)
Added
2026-09-21 (about 1 day ago)
Last Updated
2026-09-21 (about 1 day ago)

Other

Published
Title
Published
2026-02-04
Title
ProfileGrid – User Profiles, Groups and Communities < 5.9.7.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension
Published
2026-02-17
Title
SiteOrigin Widgets Bundle < 1.71.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
Published
2025-10-14
Title
Login with YourMembership - YM SSO Login < 1.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes'
Published
2026-07-08
Title
User Frontend < 4.3.8 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter
Published
2024-09-24
Title
Easy Mega Menu Plugin for WordPress – ThemeHunk < 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Settings Updates