CVE-2026-84026 PUBLISHED

Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint

Assigner: WPScan
Reserved: 01.09.2026 Published: 23.09.2026 Updated: 23.09.2026

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.

Product Status

Vendor Unknown
Product Directorist: AI-Powered Business Directory, Listings & Classified Ads
Versions Default: unaffected
  • affected from 8.1 to 8.9.5 (excl.)

Credits

  • Usama Arshad finder
  • WPScan coordinator

References

Problem Types

  • CWE-200 Information Exposure CWE