CVE-2026-84046
Deferred Deferred - Pending Action

Directory Traversal in Directorist WordPress Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-10-13
AI Q&A
2026-09-23
EPSS Evaluated
2026-10-12
NVD
CVE-2026-84046
EUVD
EUVD-2026-85034

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
directorist directorist to 8.9.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Directorist WordPress plugin before version 8.9.5. It allows users with subscriber role or higher to make the server issue requests to internal addresses by exploiting an unvalidated URL in the avatar URL field.

Detection Guidance

Check the installed version of the Directorist plugin in your WordPress admin panel. If it is below 8.9.5, the vulnerability is present. You can also inspect server logs for unusual internal requests originating from the plugin.

Impact Analysis

An attacker could use this flaw to access internal resources on your server, potentially leading to data breaches, unauthorized access to sensitive information, or further exploitation of internal systems. It may also allow network reconnaissance.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA compliance requirements. It may result in data exposure, unauthorized processing, or breaches of confidentiality.

Mitigation Strategies

Update the Directorist plugin to version 8.9.5 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84046. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart