CVE-2026-84026 — Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint

CVE-2026-84026

Directorist 8.1 - 8.9.4 - Unauthenticated Sensitive Data Disclosure via REST Users Endpoint PUBLISHED

Description (CNA)

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.

Affected (CNA)

Vendor / product	Versions
Unknown / Directorist: AI-Powered Business Directory, Listings & Classified Ads	affected 8.1 before 8.9.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/4311f66d-f032-4753-88e8-2afbd5d73ebc/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.