Directorist EUVD-2026-85033

Requires an authenticated account of subscriber role or above (PR:L), so the site must permit self-registration or the attacker must otherwise obtain a low-privilege account - a common default for directory/classifieds sites. The target must run Directorist versions 8.9.1 through before 8.9.5 with its order/payment (paid-listing monetization) functionality in use for the forged records to be meaningful. No user interaction, no admin privileges, and no non-default configuration beyond having paid orders enabled are needed; exploitation is remote over the WordPress REST API with low complexity. Impact is limited to integrity (fraudulent order/payment records and misattribution) - no confidentiality or availability impact.

This is a genuine but moderate-priority issue, not an inflated high-CVSS finding. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) is internally consistent and correctly scoped to integrity-only: an authenticated low-privilege user (subscriber, PR:L) can remotely and easily (AC:L, no UI) abuse a REST endpoint that fails CWE-862 capability checks, creating paid order and payment records with arbitrary amounts attributed to other users. No CVSS conflict is present - network vector matches a WordPress REST API, and the low privilege requirement matches the described subscriber-role prerequisite. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation status is 'no public exploit identified at time of analysis.' The impact is business-logic/data-integrity fraud (fake billing/payment records, financial-record pollution, attribution to arbitrary users) rather than data theft or code execution, which correctly bounds severity to Medium/Low. Real-world priority: patch on a normal cycle for sites that allow open subscriber registration and use Directorist's paid-listing/monetization features; sites without paid orders or public self-registration face materially lower risk. The 'Authentication Bypass' tag overstates the class - this is a broken-access-control/authorization defect, not authentication bypass - so decisions should be driven by the CWE-862 authorization framing, not the tag.

An attacker self-registers a free subscriber account on a Directorist-powered site (registration is commonly open) and calls the plugin's order-creation REST API directly, which never verifies the caller's capability. They forge paid order and payment records with attacker-chosen amounts and assign them to other user accounts - enabling billing/payment-record fraud, financial data pollution, or making another user appear to have paid. No public exploit code is available at time of analysis, but the flaw is trivially reachable given the low complexity and network vector.