Skip to main content

Directorist CVE-2026-77757

| EUVDEUVD-2026-66287 MEDIUM
Path Traversal (CWE-22)
2026-08-26 WPScan GHSA-fp49-3qhx-v7jm
Path Traversal WordPress Directorist
5.4
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

5
Analysis Generated
Aug 26, 2026 - 16:19 vuln.today
CVSS changed
Aug 26, 2026 - 15:52 NVD
5.4 (MEDIUM)
Patch available
Aug 26, 2026 - 08:01 EUVD
CVE Published
Aug 26, 2026 - 06:00 cve.org
MEDIUM 5.4
CVE Published
Aug 26, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.

AnalysisAI

Path traversal in the Directorist WordPress plugin (versions 8.5 through before 8.9.3) allows subscriber-level authenticated users to relocate arbitrary server-readable image files into a publicly accessible directory and delete them from their original location. The flaw stems from unsanitized user-supplied image references passed directly to a file-move operation, exposing sensitive server files to unauthenticated public access after the move. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Directorist

View all
CVE-2021-24981 HIGH POC
7.5 Dec 21

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leadi
CVE-2022-3961 MEDIUM POC
6.5 Dec 19

The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessi
CVE-2022-3930 MEDIUM POC
6.5 Dec 12

The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to chan
CVE-2026-59518 CRITICAL
9.8 Jul 13

PHP Object Injection in the wpWax Directorist WordPress plugin (all versions through 8.8.2) lets remote attackers pass u
CVE-2022-2376 MEDIUM POC
5.3 Sep 05

The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to bo
CVE-2022-2046 MEDIUM POC
4.9 Aug 08

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor direc
CVE-2023-1888 HIGH
8.8 Jun 09

The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including,
CVE-2022-2377 MEDIUM POC
4.3 Aug 22

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing an
CVE-2025-1570 HIGH
8.1 Feb 28

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to
CVE-2023-1889 MEDIUM
6.5 Jun 09

The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and includi
CVE-2024-1322 MEDIUM
5.3 Feb 29

The Directorist - WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to
CVE-2026-39509 MEDIUM
5.3 Apr 08

Broken access control in wpWax Directorist WordPress plugin versions up to 8.5.10 allows unauthenticated remote attacker

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Share

CVE-2026-77757 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy