Veille CVE

Recherche « Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads »

8 CVE

Critique 0 Élevée 0 Moyenne 7 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads » ✕
  1. CVE-2026-84150 5.4 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.

  2. CVE-2026-84098 6.5 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.

  3. CVE-2026-84046 5.0 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.

  4. CVE-2026-84027 4.3 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.

  5. CVE-2026-84026 5.3 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.

  6. CVE-2026-77766 4.3 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to 8.9 are not affected. The endpoint was scoped correctly in 8.8.1 and the unscoped behaviour was reintroduced in 8.9.1.

  7. CVE-2026-84066 3.1 Faible

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.

  8. CVE-2026-77757 5.4 Moyenne

    Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.