CVE-2026-77766

Executive Summary

CVE-2026-77766 is an authorization flaw (CWE-639, Insecure Direct Object Reference / improper access control) in the WordPress plugin "Directorist: AI-Powered Business Directory, Listings & Classified Ads" affecting versions 8.9.1 through 8.9.x before 8.9.5. A REST collection endpoint was re-scoped incorrectly starting in version 8.9.1, allowing any authenticated user with only a subscriber-level account to read every customer's order and payment records. The CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting limited confidentiality impact requiring low privileges.

Technical Analysis

The vulnerability resides in a REST collection endpoint exposed by the Directorist WordPress plugin. In WordPress, REST endpoints are registered via register_rest_route() and access control is normally enforced through the permission_callback argument or an explicit capability/ownership check inside the handler. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the class of flaw where an object identifier supplied by the requester is not validated against the requester's authorization scope — here, the endpoint is described as not being "scoped to the requesting user."

According to the NVD description, the endpoint returns order and payment records across all customers rather than only those belonging to the authenticated caller. The unscoped behavior was reintroduced in version 8.9.1 after having been correctly scoped in versions 8.8.1 through 8.9. This indicates a regression during refactoring or feature addition rather than a novel design flaw.

Because the endpoint is a network-reachable REST route (AV:N) and requires only a subscriber-level account (PR:L), the barrier to exploitation is low: any registered user — including self-registered accounts on sites that permit open registration — can obtain the data without user interaction (UI:N) and without modifying state (I:N, A:N). Confidentiality impact is rated Low (C:L), likely because the exposed records are read-only disclosure of a limited data class, not administrative takeover.

Insufficient technical detail is available in the provided data to name the specific route, parameter, or handler function; no public PoC, exploit code, or Nuclei template exists as of this writing.

Exploitation Scenarios

The following chain is inferred strictly from the vulnerability class and the NVD description; no specific endpoint path or parameter name is provided in the source data.

1. Reconnaissance / target identification: An attacker identifies a WordPress site running the Directorist plugin in the affected version range (8.9.1 to <8.9.5). This is trivially detectable because WordPress plugins expose enumerable asset paths (e.g., /wp-content/plugins/directorist/...) and version strings visible in page source. No authentication or special tooling is required.

2. Privilege acquisition: The attacker registers a standard subscriber-level account (typically via /wp-login.php?action=register on sites with open registration) or reuses any existing low-privileged credentials. The flaw requires only a subscriber-level account per CVSS PR:L.

3. Triggering the flaw: The attacker issues an HTTP request to the Directorist REST collection endpoint that returns customer order and payment records. Because the endpoint is not scoped to the requesting user, the collection is returned in full rather than filtered by the caller's identity — the classic CWE-639 pattern where the supplied object scope is trusted without an ownership or capability check. The attacker does not need to guess or manipulate a specific object ID if the endpoint returns the entire collection; if a pagination or filter parameter exists, the attacker can enumerate all records by iterating it.

4. Post-exploitation impact: The attacker harvests customer names, order details, and payment records. This information is directly monetizable/fraud-enabling and can seed follow-on phishing or business-email-compromise campaigns targeting the site's customers. No integrity or availability impact is expected, matching the CVSS subscores.

No public PoC is available; the attack chain above is inferred from the vulnerability class.

Impact Assessment

The blast radius is every customer whose order and payment records are stored by the affected Directorist installation — potentially the full customer base of an e-commerce-enabled directory site. Because disclosure is read-only and requires only a subscriber account, the primary business risks are:

• Privacy / regulatory: Exposure of payment-related records may constitute a reportable personal-data breach under GDPR, CCPA, and similar regimes.
• Fraud enablement: Order and payment metadata can be used to craft convincing phishing or invoice-fraud campaigns against affected customers.
• Reputational: Disclosure of a subscriber-exploitable data leak damages trust in the site operator.

CVSS subscores confirm scope is unchanged (S:U), the attack is network-reachable (AV:N) with low complexity (AC:L), requires low privileges (PR:L), no user interaction (UI:N), and results solely in limited confidentiality loss (C:L). EPSS is not yet scored by FIRST.org; CISA KEV does not list this CVE.

Detection Guidance

Sigma Rule

title: Directorist Unscoped REST Collection Access (CVE-2026-77766)
id: 7b1e9f2a-3c44-4d5e-9a10-0f6c8d2b7e91
status: experimental
description: Detects subscriber-level access to the Directorist REST collection endpoint returning order/payment records across all customers.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77766
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_plugin:
    cs-uri-query|contains:
      - '/wp-json/directorist'
      - '/directorist/'
  selection_rest:
    cs-uri-query|contains: 'rest_route'
  selection_orders:
    cs-uri-query|contains:
      - 'order'
      - 'payment'
  condition: (selection_plugin or selection_rest) and selection_orders
fields:
  - c-ip
  - cs-username
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate administrator dashboards querying order collections
  - Automated plugin maintenance tasks
level: medium
tags:
  - attack.t1213
  - cve.2026-77766

YARA Rule

rule CVE_2026_77766_Directorist_Unscoped_REST
{
    meta:
        description = "Detects Directorist plugin files version 8.9.1-8.9.x vulnerable to unscoped REST collection (CVE-2026-77766)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77766"
        cve = "CVE-2026-77766"

    strings:
        $plugin = "directorist" ascii nocase
        $wp_rest = "register_rest_route" ascii
        $rest_ns = "/directorist/" ascii nocase
        $perm_cb = "permission_callback" ascii

    condition:
        $plugin and $wp_rest and $rest_ns
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77766 Directorist Unscoped REST Collection Access Attempt"; flow:to_server,established; http.uri; content:"/wp-json/"; content:"directorist"; http.uri; content:"order"; http.method; content:"GET"; classtype:attempted-recon; reference:cve,2026-77766; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-77766; sid:202677766; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and
      url.path : "/wp-json/*" and url.path : "*directorist*" and http.request.method == "GET" ]
  [ network where network.protocol == "http" and
      url.query : "*order*" or url.query : "*payment*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/wp-json/*" uri_path="*directorist*"
| search uri_path="*order*" OR uri_path="*payment*" OR uri_query="*order*"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_path) as paths by src_ip, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,directorist,">
  <rule id="2026777" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <url>/wp-json/.*directorist.*(order|payment)</url>
    <description>CVE-2026-77766: Potential Directorist unscoped REST collection access</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_77766,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict or disable open user registration so attacker-controlled subscriber accounts cannot be created.
   • Block or rate-limit external access to the affected REST namespace at the WAF/reverse-proxy layer until a fix is available.
   • Audit any site running Directorist 8.9.1–8.9.x for evidence of subscriber-issued requests to order/payment collection endpoints.
   • If the plugin version can be safely rolled back, revert to a version in the 8.8.1–8.9 range, which the NVD description confirms is not affected.

2. Patch/upgrade steps:

   • No official patch is currently available. The vendor-designated fixed version is 8.9.5; monitor the vendor for release.
   • Until 8.9.5 is available, treat rollback to the last known-good scoped version (8.8.1–8.9) as the only fully reliable remediation if functionally viable.

3. Long-term hardening:

   • Enforce object-level authorization on all REST collection endpoints via permission_callback and per-request ownership checks; add regression tests covering the re-scoping of collection endpoints.
   • Adopt least-privilege for subscriber roles and disable self-registration unless business-required.
   • Integrate plugin version monitoring and CVE alerting for all installed WordPress components.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77766
• CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
• WordPress REST API Handbook (permission_callback / authorization): https://developer.wordpress.org/rest-api/
• CISA KEV Catalog (CVE-2026-77766 not listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored): https://www.first.org/epss/

No known threat actor campaigns or exploit-in-the-wild evidence exists for CVE-2026-77766 as of this writing.