CVE-2026-77757 PUBLISHED

Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission

Assigner: WPScan
Reserved: 21.08.2026 Published: 26.08.2026 Updated: 26.08.2026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.

Product Status

Vendor Unknown
Product Directorist: AI-Powered Business Directory, Listings & Classified Ads
Versions Default: unaffected
  • affected from 8.5 to 8.9.3 (excl.)

Credits

  • Revanth Hari Narayana Matte finder
  • WPScan coordinator

References

Problem Types

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE