CVE-2026-84026: Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress pluginto a version that resolves this vulnerability.Fixed in 8.9.5
Event History
Frequently Asked Questions
Which deployments are affected?
Directorist versions before 8.9.5 are affected. The issue is in the plugin's REST users endpoint.
Does an attacker need an account or other authentication?
No. An unauthenticated attacker can access the affected endpoint and read registered users' private contact details.
How can I determine whether my site is exposed?
Check the installed Directorist version. Sites running a version earlier than 8.9.5 should be treated as exposed.
What should be prioritized for remediation?
Update Directorist to version 8.9.5 or later. The provided information does not identify a workaround for sites that cannot be updated immediately.