What is the CVSS score of CVE-2026-59518?

CVE-2026-59518 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Directorist are affected by CVE-2026-59518?

The wpWax Directorist WordPress plugin (versions through 8.8.2) contains a critical remote code execution vulnerability accessible to unauthenticated attackers over the network.

How to fix or mitigate CVE-2026-59518?

Within 24 hours: inventory all WordPress instances for wpWax Directorist installation and document affected versions; disable and deactivate the plugin immediately in production environments; deploy Web Application Firewall rules to block PHP object injection exploitation attempts. Within 7 days: review WordPress access logs, WAF logs, and database logs for signs of exploitation or suspicious deserialization activity; verify backup integrity and isolation; establish a list of all affected sites ranked by criticality. Within 30 days: monitor Patchstack security advisories for vendor patch release; evaluate alternative WordPress directory plugins as potential replacements; prepare and test a rapid deployment procedure for patching or migrating away from this plugin once a fix is available.

Directorist CVE-2026-59518

EUVD-2026-43431 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-13 Patchstack

WordPress Deserialization Directorist Wordpress Plugin Wpwax

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable unauthenticated object-injection per the disclosed vector; if a gadget chain enables RCE, C/I/A are all High, matching the reported 9.8.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:22 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through <= 8.8.2.

AnalysisAI

PHP Object Injection in the wpWax Directorist WordPress plugin (all versions through 8.8.2) lets remote attackers pass untrusted serialized data into a PHP deserialization sink, instantiating arbitrary objects that can trigger POP gadget chains for code execution, data theft, or site compromise. The flaw carries a critical 9.8 CVSS score with an unauthenticated network vector; it was disclosed by Patchstack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Directorist is a WordPress business-directory and classified-listings plugin (CPE cpe:2.3:a:wpwax:directorist) built on PHP. The root cause is CWE-502, Deserialization of Untrusted Data: the plugin passes attacker-influenced input to PHP's unserialize() (or equivalent), allowing an attacker to control the type and properties of instantiated PHP objects. This is classic PHP Object Injection - the vulnerability itself does not run code, but when a suitable 'POP' (Property-Oriented Programming) gadget chain exists in the plugin, WordPress core, or another loaded plugin, the crafted object graph can be steered through magic methods (__wakeup, __destruct, __toString) into file writes, SQL operations, or arbitrary code execution.

RemediationAI

No specific vendor-released fix version is included in the provided data; because the flaw affects versions through <= 8.8.2, administrators should upgrade Directorist to the next release above 8.8.2 as soon as the vendor publishes it and consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/directorist/vulnerability/wordpress-directorist-plugin-8-8-2-php-object-injection-vulnerability) for the exact patched version. As interim compensating controls, deploy a WordPress WAF or Patchstack virtual patch to block serialized-payload patterns targeting Directorist endpoints, restrict or disable the specific Directorist forms/AJAX actions that accept the unserialized input where feasible (accepting reduced directory functionality), and audit for other plugins that could supply POP gadget chains. If the vulnerable code path can be tied to a particular listing/import feature, temporarily disabling that feature reduces exposure at the cost of that functionality.