CVE-2026-84066: Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with the subscriber role or a higher-privileged role can exploit it. The affected plugin does not verify that the requester owns the post whose image metadata is being changed.
What access does an attacker need?
The attacker needs a valid WordPress account with at least subscriber-level access and the ability to invoke the atbdp_post_attachment_upload functionality. No unauthenticated attack path is described.
What can an attacker change?
An attacker can overwrite uploaded-file references stored in image metadata for posts owned by other users. The available information does not establish that they can modify other post content or metadata types.
Which versions should be remediated?
Directorist versions earlier than 8.9 are affected. Upgrade to version 8.9 or later.