CVE-2026-77757: Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a subscriber-level account or higher. The vulnerable REST v2 listing-submission functionality is the affected path.
What is the impact of successful exploitation?
An authenticated attacker can cause arbitrary server-readable image files to be moved into a publicly accessible directory. The moved files are deleted from their original locations, creating both exposure and availability risks.
Which versions require remediation?
Directorist versions before 8.9.3 are affected. Updating to 8.9.3 or later addresses the vulnerable behavior.