Directorist CVE-2026-84098

Requires an authenticated account of at least Subscriber level on a WordPress site running the Directorist plugin from version 3.1.0 up to (but not including) 8.9.5 - practically exploitable wherever the site permits public self-registration (the default WordPress 'Anyone can register' setting), which is common on directory and classified-ad sites. Exploitation targets a specific unaddressed listing-deletion code path that the fixes for CVE-2023-1889 / CVE-2023-35052 did not cover; no elevated privileges, no user interaction, and no non-default plugin configuration are required beyond having the plugin installed. Limiting factor: sites that disable open registration or restrict Subscriber creation raise the bar to obtaining any valid account first.

This is a genuine but moderate-priority integrity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) shows a network-reachable, low-complexity flaw requiring only Subscriber-level authentication (PR:L) and no user interaction - a low bar on any Directorist site that allows public registration, which many directory/classified sites do by design. The impact is integrity-only (I:H): destructive deletion of arbitrary listings, including those owned by other users. There is no confidentiality (C:N) or availability-of-service (A:N) impact, though loss of listings is effectively a data-destruction event for affected owners. Signal alignment: no EPSS score, no CISA KEV entry, and no public POC were provided, so this is not confirmed as actively exploited or trivially weaponized in the wild. However, one signal materially raises concern beyond the raw score: the description states this is an INCOMPLETE FIX of the previously-known CVE-2023-1889 / CVE-2023-35052, meaning the arbitrary-listing-deletion technique is already public knowledge from 2023 and attackers/researchers already understand the abuse path - only a new, unaddressed code path is being exploited. That prior-art history makes rediscovery and exploitation more plausible than the empty EPSS/KEV/POC fields alone would suggest. Net: real priority for any Directorist site with open registration, but not an emergency-patch/CISA-KEV-tier issue.

An attacker registers a free Subscriber account on any WordPress site running Directorist before 8.9.5 (open self-registration is common on directory/classifieds sites). They then invoke the unprotected listing-deletion path - the one the 2023 fixes missed - supplying the ID of a listing they do not own, and the plugin deletes it without verifying ownership. Because this reuses a publicly documented technique from CVE-2023-1889/CVE-2023-35052, low complexity (AC:L) applies, though no fresh public POC for this specific path was provided.