CVE-2026-84066
Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload
CVSS Score
3.1
EPSS Score
0.0%
EPSS Percentile
0th
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.
| Vendor | unknown |
| Product | directorist: ai-powered business directory, listings & classified ads |
| Published | Sep 4, 2026 |
| Last Updated | Sep 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown directorist: ai-powered business directory, listings & classified ads
Be the first to know when new low vulnerabilities affecting unknown directorist: ai-powered business directory, listings & classified ads are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Directorist: AI-Powered Business Directory, Listings & Classified Ads
0 < 8.9
References
Credits
ryan zegar WPScan