Directorist CVE-2026-84026

The only prerequisite is that a target WordPress site runs the Directorist plugin (versions 8.1 up to but not including 8.9.5) with its REST API reachable, which is the default. No authentication, no user interaction, and no special configuration are required - this is remote unauthenticated exploitation against default configurations of the Directorist plugin. The practical limits on impact, not on exploitability, are that only registered users' contact records are exposed (confidentiality only, no write or system access) and that sites patched to 8.9.5 or later are not affected.

All signals converge on a moderate-severity, easy-to-exploit but limited-impact information disclosure. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) indicates fully remote, low-complexity, unauthenticated exploitation with no user interaction - the ideal profile for opportunistic mass scanning - but impact is confined to confidentiality of low-sensitivity data (C:L), with no integrity or availability effect. This is consistent with CWE-200 and the 'Information Disclosure' tag. There is no EPSS score, no CISA KEV listing, and no published proof-of-concept provided in the input, so this is not a confirmed-exploited priority; it reads as a real but modest hardening issue rather than an emergency. The most likely real-world use is automated harvesting of registered users' private contact details (email/phone) for spam, phishing, or credential-stuffing target lists. Note one nuance to verify: the description characterizes this as unrestricted access to a REST endpoint returning private contact details, which could arguably warrant a higher confidentiality rating (PII exposure) than C:L - but WPScan's rating of C:L (treating the exposed fields as low-sensitivity) is defensible and I concur with the 5.3 base score.

An unauthenticated attacker sends a crafted request to the plugin's unprotected REST endpoint (e.g. the users route) on any site running Directorist before 8.9.5, and the endpoint returns registered users' private contact records without any authentication check. The attacker scripts this across many sites to bulk-harvest email addresses and phone numbers for phishing or spam campaigns. No public proof-of-concept is identified in the provided data, though the WPScan advisory documents the flaw.