Directorist CVE-2026-84046

Requires an authenticated account with subscriber role or above, so the site must permit user registration (default-open registration is typical for directory/classified-ad deployments, the plugin's core use case). The affected feature accepts a user-supplied URL that the server fetches without validation, so the site must expose that server-side fetch functionality and the target internal addresses must be reachable from the web server. No user interaction beyond the attacker's own action is needed (UI:N). Limiting factors: low-privilege authentication is mandatory (PR:L), impact is confidentiality-only and limited, and versions before 8.9.5 are vulnerable - updating to 8.9.5 remediates.

This is a moderate-severity server-side request forgery (CWE-918) with a provider CVSS of 5.0 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). The network vector and low complexity make exploitation trivial, but the PR:L requirement is the key limiter: an attacker must hold at least a subscriber account, which is only meaningful on Directorist sites that permit open/self-registration (common for directory/classified-ad sites, which is the plugin's core use case). Impact is confidentiality-only and limited (C:L, I:N, A:N) - this is effectively a blind/limited SSRF letting an authenticated low-privilege user coerce the server into requesting internal addresses, useful for internal network mapping, hitting cloud metadata endpoints, or reaching services otherwise firewalled from the internet, rather than direct data exfiltration or code execution. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no signal of active exploitation; this is a patch-during-normal-cycle issue, not an emergency. Exploitation status: no public exploit identified at time of analysis. The scope change (S:C) reflects that the request originates from the vulnerable web server but affects other internal systems - a defensible SSRF scoring choice.

An attacker registers a subscriber account on a Directorist-powered directory site that allows self-registration, then submits a crafted URL to the vulnerable server-side fetch feature pointing at an internal address (e.g., http://169.254.169.254/ cloud metadata or an internal service). The server issues the request on the attacker's behalf, enabling internal reconnaissance or access to otherwise unreachable endpoints. No public exploit code is identified at time of analysis; the flaw was reported by WPScan.