CVE-2026-84150: Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user with subscriber-level access can exploit it. The vulnerable REST route lets that user read and modify saved favorites belonging to another user.
What versions are affected?
Directorist versions before 8.9.5 are affected. Upgrading to 8.9.5 or later addresses the affected version range.
What is the impact if the issue is exploited?
An attacker can access another user's saved favorites and alter them. This can expose users' saved listing preferences and allow unauthorized changes to those favorites.