Directorist CVE-2026-59518

Exploitation requires that a Directorist input processing serialized data reaches a PHP deserialization sink AND that a usable POP gadget chain is present in the loaded PHP code (Directorist, WordPress core, or another active plugin) - without such a gadget, object injection yields limited or no impact. The provided CVSS vector indicates no privileges and no user interaction (PR:N/UI:N) against network-reachable endpoints of Directorist <= 8.8.2, but the description does not state which feature or endpoint accepts the input, so the precise triggering configuration should be confirmed against the Patchstack advisory. Limiting factors: dependency on an exploitable gadget chain, the specific plugin version (8.8.2 or earlier), and - pending verification - the possibility that the vulnerable action requires an authenticated role despite the PR:N rating.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes an unauthenticated, low-complexity remote attack with full confidentiality, integrity, and availability impact - nominally a top-priority issue. However, real-world exploitability of PHP object injection depends entirely on the availability of a usable POP gadget chain, which the description does not confirm; without a reachable gadget the flaw may yield only limited or no impact, so the 9.8 could overstate practical risk. No EPSS score, SSVC decision data, POC, or KEV listing was provided, so exploitation probability cannot be quantified from the input - the absence of KEV suggests no confirmed active exploitation. Note also that many Patchstack-reported plugin object-injection issues in practice require some authenticated context; the input vector states PR:N, but since the description gives no auth detail this should be verified against the Patchstack advisory before treating it as strictly pre-auth.

An attacker submits a crafted serialized PHP payload to a Directorist input that reaches unserialize(), causing the plugin to instantiate a malicious object graph that chains through available magic methods on the target site. If a suitable POP gadget exists in Directorist, WordPress core, or a co-installed plugin, this can escalate to arbitrary file writes or remote code execution, fully compromising the site. No public proof-of-concept was identified at time of analysis, and successful exploitation hinges on a reachable gadget chain in the specific deployment.