What is the CVSS score of CVE-2026-77757?

CVE-2026-77757 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-77757?

Yes, a public proof-of-concept exploit is available for CVE-2026-77757. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-77757?

Yes, a patch is available for CVE-2026-77757. Update the affected software to the latest version immediately.

Directorist CVE-2026-77757

EUVD-2026-66287 MEDIUM

Path Traversal (CWE-22)

2026-08-26 WPScan

GHSA-fp49-3qhx-v7jm

WordPress Path Traversal Directorist Unknown

5.4

CVSS 3.1 · Vendor: WPScan

View

Vulnerability Assessment

Weakness

CWE

CWE-22

OWASP Top 10:2025

A01:2025 - Broken Access Control

ASVS 5.0

V5 - File Handling Path canonicalization, traversal prevention

MITRE ATT&CK

2 techniques across 2 tactics: Discovery, Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 26, 2026

Path traversal in the Directorist WordPress plugin (versions 8.5 through before 8.9.3) allows subscriber-level authenticated users to relocate arbitrary server-readable image files into a publicly accessible directory and delete them from their original location. The flaw stems from unsanitized user-supplied image references passed directly to a file-move operation, exposing sensitive server files to unauthenticated public access after the move. Publicly available exploit code exists per WPScan reporting; however, EPSS sits at 0.19% (9th percentile), and the requirement for a subscriber-level account limits opportunistic mass exploitation.

Affected VersionsENISA

Directorist: AI-Powered Business Directory, Listings & Classified Ads 8.5 <8.9.3

Affected Packages

euvd directorist_ai_powered_business_directory_listings_classified_ads fix: 8.9.3

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Directorist gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (WPScan) PRIMARY 5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Aug 26, 2026 - 15:52 NVD

5.4 (MEDIUM)

Patch available

Aug 26, 2026 - 08:01 EUVD

CVE Published

Aug 26, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 26, 2026 - 06:00 cve.org

MEDIUM 5.4

DescriptionCVE.org

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.

Threat Intelligence Overview

EPSS Score

0.2%

Top 91% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +27

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Path Traversal HIGH

Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.

More in Directorist

View all

CVE-2021-24981 HIGH This Week POC

7.5 Dec 21

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leadi

CVE-2022-3961 MEDIUM This Month POC

6.5 Dec 19

The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessi

CVE-2022-3930 MEDIUM This Month POC

6.5 Dec 12

The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to chan

CVE-2026-22337 CRITICAL Act Now

9.8 Apr 27

Remote unauthenticated attackers can escalate privileges to administrator level in Directorist Social Login WordPress pl

CVE-2026-59518 CRITICAL Act Now

9.8 Jul 13

PHP Object Injection in the wpWax Directorist WordPress plugin (all versions through 8.8.2) lets remote attackers pass u

CVE-2022-2376 MEDIUM This Month POC

5.3 Sep 05

The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to bo

CVE-2022-2046 MEDIUM This Month POC

4.9 Aug 08

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor direc

CVE-2023-1888 HIGH This Week

8.8 Jun 09

The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including,

CVE-2022-2377 MEDIUM This Month POC

4.3 Aug 22

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing an

CVE-2026-17092 HIGH This Week

8.1 Oct 14

Authorization bypass in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress (

CVE-2025-1570 HIGH This Week

8.1 Feb 28

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to

CVE-2026-84066 LOW Monitor POC

3.1 Sep 04

Missing post-ownership authorization in Directorist WordPress plugin before 8.9 allows any authenticated subscriber-leve

Same weakness CWE-22 – Path Traversal

View all

CVE-2019-3396 CRITICAL POC

9.8

CVE-2019-19781 CRITICAL POC

9.8

CVE-2020-5902 CRITICAL POC

9.8

CVE-2021-21972 CRITICAL POC

9.8

CVE-2021-40444 HIGH POC

8.8

CVE-2022-41352 CRITICAL POC

9.8

CVE-2021-27065 HIGH POC

7.8

CVE-2019-11510 CRITICAL POC

10.0

Same technique Path Traversal

View all

CVE-2018-20250 HIGH POC

7.8

CVE-2022-37042 CRITICAL POC

9.8

CVE-2025-64446 CRITICAL POC

9.8

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-77757

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back