Directorist EUVD-2026-70912

Exploitation requires a valid WordPress user account at the subscriber role or higher - the lowest authenticated role, which is granted to anyone who completes open registration on the site. The attacker must be able to upload a file through the Directorist plugin's upload interface and know or enumerate a valid post ID belonging to another user; WordPress post IDs are sequential integers, making enumeration straightforward. Sites that disable open user registration are not exploitable by external attackers. The impact is limited to overwriting image metadata on posts - no code execution, no credential disclosure, and no availability impact are possible through this vector alone.

The CVSS 3.1 base score of 3.1 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N appropriately reflects the limited blast radius - only image metadata integrity on individual posts is affected, with no confidentiality or availability impact. The AC:H assignment from the vendor may reflect the need to identify a valid target post ID, though in practice WordPress post IDs are sequential and easily discoverable, which would argue for AC:L. The PR:L requirement correctly captures that a subscriber account (the lowest authenticated role in WordPress) is sufficient. There is no CISA KEV listing and no EPSS data provided, so exploitation probability cannot be independently quantified. A WPScan-published POC exists, lowering the bar for exploitation by low-skilled actors targeting multi-author or marketplace-style directory sites. Even a mid-sized municipal IT team in radom operating a Directorist-powered public business directory - where untrusted subscriber accounts exist - faces meaningful cross-user tampering risk if listings are monetized or reputation-sensitive. Overall, real-world priority is low-to-medium: the restricted impact scope limits damage, but the low authentication barrier combined with POC availability warrants prompt patching on sites with open registration.

An attacker registers a free subscriber account on a Directorist-powered business directory site, uploads an image file through the listings interface, and intercepts or crafts the resulting metadata write request to substitute a victim's post ID in place of their own. Because the plugin does not verify post ownership before persisting the file reference, the attacker's uploaded image metadata overwrites the legitimate listing owner's images, potentially defacing competitor listings or injecting inappropriate content. A WPScan proof-of-concept for this technique is publicly available, making the exploit accessible to low-skill threat actors.