CVE-2026-84026

Executive Summary

CVE-2026-84026 is an unauthenticated information disclosure vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin affecting all versions before 8.9.5. The flaw stems from missing access controls on a REST endpoint that returns user records, allowing any unauthenticated remote attacker to retrieve registered users' private contact details. With a CVSS score of 5.3 and no public PoC or exploit code currently available, the vulnerability represents a moderate-severity privacy and reconnaissance risk to WordPress sites running the affected plugin.

Technical Analysis

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). According to the NVD description, the Directorist WordPress plugin "does not restrict access to a REST endpoint that returns user records." WordPress REST endpoints are registered via the WordPress REST API framework and are typically exposed under the /wp-json/ namespace. The core issue is an authorization failure: the endpoint lacks a proper capability check or authentication requirement, meaning it responds to unauthenticated HTTP requests.

The attack surface is the WordPress REST API, which is publicly reachable on most WordPress installations by default. Because the endpoint returns "user records" containing "registered users' private contact details," the exposure includes data that should normally require authentication or elevated privileges. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms the following: the vulnerability is network-exploitable (AV:N), requires no special conditions (AC:L), needs no privileges (PR:N), requires no user interaction (UI:N), affects only the vulnerable component (S:U), and results in limited confidentiality impact only (C:L), with no integrity or availability impact.

No specific endpoint path, parameter names, or function names are provided in the available data. The precise REST route, HTTP method, and response schema are not disclosed in the NVD description. The vulnerability class — improper access control on a REST API endpoint exposing user data — is well-established in WordPress plugin security. The absence of detail about the exact route means defenders must rely on class-level detection rather than signature-specific matching.

Importantly, this is an information disclosure issue, not remote code execution or authentication bypass. The confidentiality impact is rated "Low" because the exposed data is limited to contact details rather than full account takeover primitives (such as password hashes or session tokens).

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available for CVE-2026-84026. The attack chain below is inferred strictly from the vulnerability class (improper access control on a REST endpoint returning user records) and the NVD description. No specific endpoint paths or parameter names are invented.

1. Reconnaissance / Target Identification: An attacker identifies WordPress sites running the Directorist plugin below version 8.9.5. This can be done through passive fingerprinting — for example, scanning for known Directorist plugin assets served from the site, or enumerating the publicly exposed WordPress REST API namespace. Shodan and similar internet-wide scanners can identify candidate targets by plugin-related HTML markers.

2. Triggering the Flaw: Because the vulnerable REST endpoint does not enforce access restrictions, the attacker sends an unauthenticated HTTP request to that endpoint. The request requires no credentials, no session cookie, and no special headers. The WordPress REST API is reachable over the network by default, which satisfies the AV:N/PR:N/UI:N conditions of the CVSS vector.

3. Payload / Execution Method: At the vulnerability-class level, the "payload" is simply a crafted unauthenticated GET request to the affected REST route. There is no injection, no memory corruption, and no code execution. The server processes the request and returns a response body containing user records — including private contact details — that the requester is not authorized to see. Because the flaw is an access-control omission, the exploit does not require circumventing any filter; it relies on the endpoint's default permissive behavior.

4. Post-Exploitation Impact: The attacker collects the returned user records and extracts private contact details. This data can be aggregated across multiple targets, used for targeted phishing or social engineering, sold or leaked, or combined with other OSINT to build detailed profiles of registered users. Given the "Low" confidentiality rating and the fact that no public exploit exists, mass automated exploitation is unlikely at present, but the data is trivially retrievable by any party who knows or discovers the endpoint.

Impact Assessment

The CVSS 3.1 base score is 5.3 (Medium), derived from AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The subscores indicate:

• Confidentiality (Low): Private contact details of registered users are exposed. This is sensitive personal data (potentially PII) but does not directly enable account takeover.
• Integrity (None): No data can be modified.
• Availability (None): No service disruption.

The blast radius is any WordPress website running Directorist below version 8.9.5 with the REST API accessible. Because the endpoint returns registered user records, the impact scales with the size and sensitivity of the site's user base. A business directory site — Directorist's primary use case — may host listings from many businesses and individuals, meaning the exposed contact details could affect a substantial number of data subjects. This creates regulatory exposure under privacy regimes such as GDPR or CCPA if the contact details qualify as personal data, and reputational risk for site operators. The lack of any public exploit or KEV listing indicates no known active exploitation in the wild as of this report, but the low barrier to exploitation (no authentication, no tooling) makes the vulnerability attractive for opportunistic scraping and reconnaissance.

Detection Guidance

Sigma Rule

title: Directorist Unauthenticated REST Endpoint User Record Access (CVE-2026-84026)
id: 8f3c1b2a-4d5e-4f6a-9b7c-1e2d3f4a5b6c
status: experimental
description: Detects unauthenticated HTTP requests to the Directorist WordPress plugin REST endpoint that returns user records, indicative of CVE-2026-84026 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84026
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method: 'GET'
  selection_uri:
    cs-uri-stem|contains: '/wp-json/'
  selection_plugin:
    cs-uri-stem|contains: 'directorist'
  selection_no_auth:
    cs-Cookie|contains: 'wordpress_logged_in'
  condition: selection_method and selection_uri and selection_plugin and not selection_no_auth
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-User-Agent
falsepositives:
  - Legitimate unauthenticated visitors browsing public directory listings
  - REST API requests to other registered routes
level: medium
tags:
  - attack.t1190
  - cve.2026.84026

YARA Rule

rule CVE_2026_84026_Directorist_REST_Exposure
{
    meta:
        description = "Detects HTTP responses or logs referencing the Directorist plugin REST endpoint associated with CVE-2026-84026 user record exposure"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84026"
        severity = "medium"

    strings:
        $plugin = "directorist" ascii wide nocase
        $rest = "/wp-json/" ascii wide nocase
        $userkey1 = "user_email" ascii wide nocase
        $userkey2 = "contact" ascii wide nocase
        $userkey3 = "\"email\"" ascii wide nocase

    condition:
        filesize < 5MB and
        ($plugin and $rest) and
        any of ($userkey*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84026 Directorist Unauthenticated REST User Record Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/wp-json/"; http.uri; content:"directorist"; nocase; http.cookie; content:"wordpress_logged_in"; nocase; negate; classtype:attempted-recon; reference:cve,2026-84026; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84026; sid:202684026; rev:1;)

Elastic Detection

network where
  http.request.method == "GET" and
  stringContains(http.request.path, "/wp-json/") and
  stringContains(toLower(http.request.path), "directorist") and
  not stringContains(http.request.headers.Cookie, "wordpress_logged_in")

Splunk SPL Query

index=web_logs
| eval uri=lower(cs_uri_stem)
| eval cookies=coalesce(cs_Cookie, cs_cookie, "")
| where like(uri, "%/wp-json/%") AND like(uri, "%directorist%") AND NOT like(lower(cookies), "%wordpress_logged_in%")
| stats count values(cs_uri_stem) as attempted_paths by src_ip, cs_User-Agent
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,directorist,">
  <rule id="1084026" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">\.*\/wp-json\/.*directorist</field>
    <field name="method">GET</field>
    <description>CVE-2026-84026: Possible unauthenticated access to Directorist REST endpoint returning user records</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_84026,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict or block access to the affected REST endpoint at the web application firewall (WAF) or reverse proxy layer. Because the exact route is not disclosed in available data, block unauthenticated access to the plugin's REST namespace under /wp-json/ where identifiable.
   • Disable the WordPress REST API for unauthenticated users via a security plugin or server configuration if directory functionality permits it.
   • Monitor web access logs for anomalous unauthenticated GET requests to the plugin's REST route.
   • Since this is an information disclosure flaw with no integrity or availability impact, prioritize based on the sensitivity of user data stored on the site.

2. Patch / Upgrade Steps:

   • Upgrade the Directorist plugin to version 8.9.5 or later, which the NVD description identifies as the fixed version.
   • Verify the upgrade in a staging environment before production rollout, and confirm the REST endpoint now enforces access restrictions.
   • After patching, purge any caches that may still serve cached responses from the vulnerable endpoint.

3. Long-term Hardening:

   • Enforce a least-privilege model for all plugin REST endpoints via WordPress capability checks (permission_callback).
   • Implement routine REST API surface reviews to identify endpoints that return user data without authorization requirements.
   • Deploy continuous vulnerability scanning for WordPress plugins and subscribe to vendor security advisories.
   • Consider minimizing exposure of personal contact details in user records where they are not operationally required.

References

1. NVD — CVE-2026-84026: https://nvd.nist.gov/vuln/detail/CVE-2026-84026
2. Directorist Official Website / Plugin Repository: https://wordpress.org/plugins/directorist/
3. CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. WordPress REST API Handbook (access control): https://developer.wordpress.org/rest-api/

No known threat actor campaigns or exploit-in-the-wild activity have been reported for CVE-2026-84026, and the CVE is not listed in CISA KEV.