Deserialization of Untrusted Data in Directorist

Executive Summary

CVE-2026-59518 is a high-severity vulnerability in the WordPress Directorist Plugin (version 8.8.2 and earlier) that allows PHP Object Injection through deserialization of untrusted data.

This flaw enables attackers to inject malicious objects into the application, potentially leading to code execution, SQL injection, path traversal, denial of service, and other harmful actions if a suitable Property-Oriented Programming (POP) chain exists.

The vulnerability requires only Subscriber-level privileges to exploit and is classified under the OWASP Top 10 category A3: Injection.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can have severe impacts including unauthorized code execution on the affected website, database compromise through SQL injection, unauthorized file access via path traversal, and denial of service conditions.

Such impacts can lead to website defacement, data theft, service outages, and potentially full control of the affected system by attackers.

Because the vulnerability can be exploited by users with minimal privileges, it poses a significant risk to website security and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Users are strongly advised to update the WordPress Directorist Plugin to version 8.8.3 or later to mitigate the risk of this PHP Object Injection vulnerability.

If updating immediately is not possible, it is recommended to seek assistance from a hosting provider or web developer.

Patchstack has provided a mitigation rule to block attacks targeting this vulnerability until the plugin can be updated.

Useful 0 Not Useful 0