CVE-2026-84027: Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with the subscriber role or a higher-privileged role can exploit it. The attacker does not need order-management capabilities because the affected REST endpoint does not enforce the required capability check.
What can an attacker do through the vulnerable endpoint?
They can create paid order and payment records with arbitrary amounts. They can also attribute those records to other users, which can corrupt payment and order data.
Which installations are affected?
Directorist versions 8.9.1 through 8.9.4 are affected. The issue is fixed in version 8.9.5.
How can I assess whether exploitation may have occurred?
Review Directorist order and payment records for unexpected paid entries, unusual amounts, and records attributed to users who did not place the associated orders. Pay particular attention to records created by subscriber-level accounts or other accounts without legitimate order-management responsibilities.