CVE-2026-84027 — Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint

CVE-2026-84027

Directorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint PUBLISHED

Description (CNA)

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.

Affected (CNA)

Vendor / product	Versions
Unknown / Directorist: AI-Powered Business Directory, Listings & Classified Ads	affected 8.9.1 before 8.9.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/dff1eca0-3fdd-4e7f-8ad2-1fa52b3b4a80/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.