Directorist CVE-2026-39509

Exploitation requires the Directorist plugin to be installed and activated on a WordPress site with at least one endpoint or form handler missing authorization checks. The vulnerability is triggered when an unauthenticated attacker directly accesses or submits to a protected plugin function without providing valid WordPress credentials or capability tokens. No special WordPress configuration, API keys, or administrative settings are required on the attacker's side; the flaw exists in the plugin's failure to validate permissions on its own endpoints regardless of site configuration.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-accessible, unauthenticated exploitation with low complexity - objectively a concerning profile. However, the EPSS score of 0.02% (4th percentile) strongly signals low real-world exploitation likelihood, suggesting either narrow technical conditions, limited attacker motivation, or minimal downstream impact despite the authorization flaw. The integrity impact (I:L) is constrained; no confidentiality or availability loss is possible. The absence of known public exploits or CISA KEV listing further supports a low-priority vulnerability. Security teams should prioritize this below high-EPSS issues but should still track patch releases, as authorization bypasses in popular plugins can be weaponized quickly once exploit code emerges.

An unauthenticated attacker crafts a direct HTTP request to a vulnerable Directorist plugin endpoint (likely a REST API route or form handler) that modifies directory listings, user profiles, or business classification data without proper permission checks. The attacker exploits the missing authorization validation to submit state changes such as editing a listing title, changing a category assignment, or altering business information - actions normally restricted to authenticated owners or administrators. Because the plugin fails to verify the attacker's credentials or capabilities, the modification is processed and persisted.