CVE-2026-77757 — Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission

CVE-2026-77757

Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission PUBLISHED

Description (CNA)

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.

Affected (CNA)

Vendor / product	Versions
Unknown / Directorist: AI-Powered Business Directory, Listings & Classified Ads	affected 8.5 before 8.9.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/84a5b1f0-b5a7-4800-91ee-813727604ec5/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.