CVE-2026-17092

Executive Summary

CVE-2026-17092 is an authorization bypass vulnerability (CWE-862, Missing Authorization) in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress, affecting all versions up to and including 8.10.2.1. Any authenticated user with subscriber-level access or higher can delete arbitrary business directory listings — including those owned by other users, as well as posts in publish, draft, or private status — because the plugin does not verify that a user is authorized to perform the delete action. With a CVSS base score of 8.1, this represents a high-severity integrity and availability threat, and no patch is currently available.

Technical Analysis

The vulnerability class is CWE-862 (Missing Authorization). According to the NVD description, the root cause is the plugin's failure to properly verify that a user is authorized to perform an action. In WordPress plugin architecture, AJAX or REST endpoints that perform state-changing actions (such as deleting a listing) must check the current user's capabilities — for example, verifying that the requester owns the listing or holds an administrative capability such as manage_options or an equivalent plugin-specific capability.

The NVD description explicitly states that the nonces guarding the endpoint do not constitute an authorization barrier. Two nonces are named: directorist_nonce and atbdp_nonce_js. These are exposed to all logged-in users via the WordPress function wp_localize_script. This is a critical design flaw: nonces in WordPress are CSRF (Cross-Site Request Forgery) tokens, not authorization controls. A nonce verifies intent and request origin, but it does not verify identity or privilege level. When a nonce is published to every logged-in user through wp_localize_script, any authenticated account — including the lowest-privileged subscriber — receives a valid nonce that will satisfy the endpoint's nonce check.

Consequently, the authorization check is effectively absent: the only barrier the endpoint enforces is possession of a nonce that is freely distributed. The endpoint accepts a request to delete a listing and executes the deletion without confirming that the requesting user owns the listing or possesses a capability that permits deletion. The attack surface is the plugin's listing-deletion endpoint, reachable over the network, requiring only a valid authenticated session (CVSS PR:L).

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) confirms: no user interaction is required, no confidentiality impact, but high integrity impact (arbitrary listings can be deleted or altered in state) and high availability impact (deleted content, including published, draft, and private posts, is removed from the site). There is no public PoC or Nuclei template, and the exact endpoint path and parameter names are not disclosed in the available description; therefore the specific request format is not enumerated here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-862) and the details explicitly provided in the NVD description.

1. Reconnaissance / target identification. The attacker identifies WordPress sites running the Directorist plugin at version 8.10.2.1 or earlier. Detection can be performed by fingerprinting the plugin's publicly accessible assets — for example, referencing the plugin directory path under /wp-content/plugins/directorist/ — or by inspecting directory listing pages that reveal the plugin's business directory functionality. The attacker confirms the target exposes the listing-deletion functionality and that self-registration or an existing low-privilege account is available.

2. Account acquisition / positioning. The attacker obtains an authenticated session at subscriber level or above. This may be through open self-registration, a compromised low-privilege account, or any existing membership. This satisfies the PR:L precondition of the CVSS vector.

3. Nonce harvesting. Because the plugin exposes directorist_nonce and atbdp_nonce_js to all logged-in users via wp_localize_script, the attacker — after logging in — loads any page where the plugin enqueues its scripts. The page source contains the localized script object, from which the attacker reads the valid nonce values. This requires no privilege escalation; a subscriber receives the same nonce material as an administrator.

4. Triggering the flaw. The attacker sends a request to the plugin's listing-deletion endpoint, including a valid nonce (directorist_nonce and/or atbdp_nonce_js) and the identifier of the target listing. The endpoint processes the request without verifying that the attacker is authorized to delete that listing. Because the plugin fails to check ownership or capability, the request succeeds even when the target listing is owned by another user or exists as a published, draft, or private post.

5. Post-exploitation impact. The attacker can delete arbitrary business directory listings, including other users' content and non-public posts (draft and private). Repeated abuse enables mass content destruction across the directory, disruption of directory-driven business operations, and potential reputational or financial harm to the site owner. There is no confidentiality impact and no server compromise implied by this CVE; the impact is integrity and availability of directory content.

At the vulnerability-class level, the essential mechanism is: an authenticated low-privilege user supplies a globally distributed CSRF nonce to an endpoint that performs a privileged state change without an authorization check, achieving unauthorized deletion of arbitrary records.

Impact Assessment

• Integrity (I:H): Arbitrary directory listings can be deleted, including listings and posts owned by other users and posts in publish, draft, or private status. Bulk abuse can corrupt or erase substantial portions of a site's directory content.
• Availability (A:H): Deletion of published listings and posts removes content from the live site, directly affecting availability of the directory service.
• Confidentiality (C:N): No confidentiality impact is indicated by the CVSS vector.
• Attack complexity (AC:L) / Privileges required (PR:L) / User interaction (UI:N): The flaw is trivially reachable over the network by any authenticated subscriber-level account with no victim interaction.
• Blast radius: Any WordPress site running Directorist <= 8.10.2.1 that allows low-privilege authenticated accounts (e.g., open registration) is exposed. The impact is scoped to the vulnerable component (S:U) but can affect all directory content and posts managed within the plugin's scope.

Business impact includes loss of directory listings that may represent paying advertisers or community content, erosion of user trust, and operational cost to restore deleted data. Because the issue is unpatched, exposure persists until the vendor releases a fix or compensating controls are applied.

Detection Guidance

Sigma Rule

title: Directorist Unauthorized Listing Deletion via Authorization Bypass (CVE-2026-17092)
id: 8f2c1d64-3b7a-4e9c-9a11-0d4b6c7e2f10
status: experimental
description: Detects authenticated requests attempting to delete Directorist listings without proper authorization, leveraging exposed directorist_nonce or atbdp_nonce_js nonces.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-17092
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_nonce:
    - 'directorist_nonce'
    - 'atbdp_nonce_js'
  selection_endpoint:
    c-uri|contains: '/wp-admin/admin-ajax.php'
  selection_action:
    cs-uri-query|contains: 'action='
  condition: selection_method and selection_nonce and selection_endpoint and selection_action
fields:
  - c-ip
  - cs-uri-query
  - cs-uri-query
falsepositives:
  - Legitimate listing owners deleting their own listings
level: high

YARA Rule

rule CVE_2026_17092_Directorist_Authz_Bypass
{
    meta:
        description = "Detects Directorist plugin versions vulnerable to CVE-2026-17092 (authorization bypass, CWE-862)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-17092"
        date = "2026-01-01"
        severity = "high"

    strings:
        $nonce1 = "directorist_nonce" ascii wide
        $nonce2 = "atbdp_nonce_js" ascii wide
        $localize = "wp_localize_script" ascii
        $dirpath = "/wp-content/plugins/directorist/" ascii

    condition:
        ($nonce1 or $nonce2) and $localize
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-17092 Directorist Authorization Bypass - Listing Deletion Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; nocase; http.request_body; content:"directorist_nonce"; nocase; http.request_body; content:"action"; nocase; reference:cve,2026-17092; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-17092; classtype:attempted-admin; sid:202617092; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "POST" and url.path == "/wp-admin/admin-ajax.php" and http.request.body contains "directorist_nonce"]
  [network where http.request.method == "POST" and url.path == "/wp-admin/admin-ajax.php" and http.request.body contains "atbdp_nonce_js"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| search method=POST uri="/wp-admin/admin-ajax.php"
| search form_data="*directorist_nonce*" OR form_data="*atbdp_nonce_js*"
| stats count values(uri) as target_uri values(form_data) as request_body by src_ip, useragent, status
| where status=200
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,directorist,">
  <rule id="2026090" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>directorist_nonce|atbdp_nonce_js</match>
    <description>CVE-2026-17092: Possible Directorist authorization bypass - listing deletion request containing exposed nonce</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_17092,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). There is currently no vendor fix or official workaround.

1. Immediate mitigations:

   • Disable or restrict self-registration and any ability for untrusted users to obtain authenticated accounts, reducing exposure to the PR:L precondition.
   • If the plugin cannot be removed, restrict access to the plugin's deletion functionality where feasible (for example, by disabling the vulnerable endpoint or limiting it to trusted roles) — note that the exact endpoint is not disclosed here and must be identified on the deployment.
   • Deploy WAF rules and the network detection rules above to flag POST requests to /wp-admin/admin-ajax.php carrying directorist_nonce or atbdp_nonce_js, and alert on bulk listing deletions.
   • Ensure comprehensive, frequent backups of directory content and WordPress posts so deleted listings and posts can be restored.

2. Patch/upgrade steps:

   • Monitor the vendor's plugin page and the NVD entry for an updated version addressing CVE-2026-17092. No fixed version exists as of this report.
   • When a patched release is published, update the plugin promptly. Until then, treat all versions up to and including 8.10.2.1 as vulnerable.

3. Long-term hardening:

   • Audit WordPress plugins for the anti-pattern of relying on nonces for authorization. Nonces are CSRF tokens and must be paired with capability and ownership checks.
   • Enforce the principle of least privilege for all accounts and restrict registration.
   • Monitor all plugin AJAX/REST endpoints for destructive actions and apply server-side authorization checks.
   • Maintain off-site, tested backups and an incident response plan for content-integrity incidents.

References

• NVD entry for CVE-2026-17092: https://nvd.nist.gov/vuln/detail/CVE-2026-17092
• CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
• WordPress Plugin Security / Nonce documentation: https://developer.wordpress.org/plugins/security/nonces/
• Directorist plugin page (vendor — monitor for patched release): https://wordpress.org/plugins/directorist/
• CISA KEV catalog (CVE-2026-17092 is NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence have been reported for this CVE as of the time of writing.