CVE-2026-84046

Executive Summary

CVE-2026-84046 is a Server-Side Request Forgery (SSRF) vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin, affecting versions prior to 8.9.5. The flaw allows any authenticated user with at least subscriber-level privileges to induce the server to issue requests to attacker-controlled or internal addresses because a user-supplied URL is not validated before server-side fetching. Successful exploitation enables internal network reconnaissance, access to cloud metadata endpoints, and potential interaction with internal-only services, with a CVSS base score of 5.0 reflecting a scope change (S:C) despite low confidentiality impact.

Technical Analysis

The vulnerability class is CWE-918, Server-Side Request Forgery. According to the NVD description, the Directorist plugin "does not validate a user-supplied URL before fetching it server-side." This means the application accepts a URL parameter from the client and passes it to a server-side HTTP client without enforcing an allowlist, scheme restriction, or resolution of the destination against private/internal address ranges. The server then performs the outbound request on behalf of the user.

Because the request originates from the web server itself, the attacker does not need direct network reachability to internal hosts. The trust boundary is crossed at the server: any address the server can reach — loopback (127.0.0.1), link-local (169.254.0.0/16, which includes cloud instance metadata services), private RFC1918 ranges, and internal hostnames — becomes reachable through the vulnerable fetch operation. The lack of validation also typically permits non-HTTP schemes (for example, file:// or gopher://) depending on the HTTP client in use, though the NVD description does not confirm which schemes are accepted, so that vector is best treated as a possibility to be verified, not an asserted fact.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N encodes the key characteristics: network exploitable (AV:N), low attack complexity (AC:L), requires low privileges (PR:L — subscriber role and above), no user interaction (UI:N), and a scope change (S:C) because the vulnerable component (the plugin) can affect resources beyond its security scope (internal services). Only confidentiality is impacted and only at a low level (C:L), reflecting that responses may be blind or only partially returned to the attacker; integrity and availability are unaffected (I:N/A:N).

The stated privilege requirement is significant: the threshold is "subscriber role and above," the lowest standard authenticated WordPress role. This substantially widens the pool of potential attackers, since subscriber registration is often open on directory and classified-ad sites. No public proof-of-concept, Nuclei template, or exploit code is available as of this report, and patch confidence is 0/4 — no patch evidence has been tracked from any source, even though the vendor release line indicates a fix version of 8.9.5.

Exploitation Scenarios

Because no public PoC exists, the following chain is inferred strictly from the SSRF vulnerability class and the NVD description; no specific function names, parameters, or endpoints are asserted beyond what the description provides.

1. Reconnaissance / target identification. The attacker identifies a WordPress site running the Directorist plugin at a version below 8.9.5. Fingerprinting can be performed through public plugin asset paths under /wp-content/plugins/directorist/ and version disclosure in readme or asset query strings. The attacker then registers or obtains a subscriber-level account.

2. Triggering the flaw class. As an authenticated subscriber, the attacker supplies a crafted URL to the plugin feature that performs server-side fetching. The URL points at an internal or loopback address rather than a legitimate external resource. Because the plugin does not validate the supplied URL, the server proceeds to fetch it.

3. Payload / execution at the vulnerability-class level. The SSRF payload is the URL itself. Typical targets include loopback services (http://127.0.0.1:/), cloud metadata endpoints (http://169.254.169.254/...), and internal RFC1918 hosts. Depending on whether the plugin returns response content to the requester, the attack may be full-read (response reflected) or blind (timing/error-based inference). The NVD description does not state whether responses are reflected, so both cases must be considered.

4. Post-exploitation impact. A successful SSRF against a cloud metadata service can expose instance credentials and configuration, enabling lateral movement into the cloud environment. Against internal services, the attacker can map the internal network, reach admin interfaces that are not exposed externally, and potentially chain into further compromise. The CVSS scope-change rating (S:C) captures this pivot beyond the plugin's own boundary.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

The business impact centers on internal network exposure and cloud metadata theft. Although the confidentiality impact is rated Low (C:L), the scope change (S:C) means the vulnerability can affect systems outside the plugin's authorization boundary — specifically, internal services and cloud instance metadata reachable by the WordPress host. Organizations running Directorist on internet-facing WordPress installations are the primary exposure group, and any deployment where subscribers can self-register effectively lowers the bar to exploitation.

The blast radius depends heavily on the network position of the WordPress host: a host in a flat internal network or in a cloud VPC with metadata service access represents the highest risk. The low privilege requirement (PR:L) and lack of user interaction (UI:N) make this attractive for automated mass scanning once an exploit matures, even though none is currently public. No CISA KEV listing and no EPSS score are available at the time of writing.

Detection Guidance

Sigma Rule

title: Directorist SSRF Attempt - Subscriber Fetch to Internal Address
id: 8c1f2a44-9b7e-4d2c-a1f0-202684046000
status: experimental
description: Detects authenticated requests that supply internal, loopback, or metadata URLs to the vulnerable Directorist plugin fetch functionality.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84046
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-query|contains:
      - 'directorist'
  selection_ssrf:
    cs-uri-query|contains:
      - '127.0.0.1'
      - 'localhost'
      - '169.254.169.254'
      - '10.'
      - '192.168.'
      - '172.16.'
      - 'file://'
      - 'gopher://'
  condition: selection_path and selection_ssrf
falsepositives:
  - Legitimate administrative configuration referencing localhost
level: medium
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_84046_Directorist_SSRF
{
    meta:
        description = "Detects Directorist plugin code lacking URL validation prior to server-side fetch (CVE-2026-84046)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84046"
        date = "2026-01-01"
    strings:
        $plugin = "directorist" ascii nocase
        $fetch1 = "wp_remote_get" ascii
        $fetch2 = "wp_remote_post" ascii
        $fetch3 = "curl_exec" ascii
        $urlvar = "$_GET[" ascii
        $urlvar2 = "$_POST[" ascii
    condition:
        $plugin and 1 of ($fetch*) and 1 of ($urlvar*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84046 Directorist SSRF Attempt - Internal Address in Request"; flow:to_server,established; http.uri; content:"directorist"; nocase; http.uri; pcre:"/(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[01])\.\d+\.\d+)/i"; classtype:attempted-recon; sid:202684046; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where url.path : "*directorist*" and url.query : "*127.0.0.1*" ]
  [ network where url.path : "*directorist*" and url.query : "*169.254.169.254*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*directorist*"
| regex uri_query="(?i)(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[01])\.\d+\.\d+|file://|gopher://)"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-84046,">
  <rule id="202684046" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>directorist</match>
    <regex>(?i)(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[01])\.\d+\.\d+|file://|gopher://)</regex>
    <description>CVE-2026-84046: Directorist SSRF attempt against internal address</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_84046,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict or disable self-registration to reduce the number of accounts able to reach the vulnerable feature. Where feasible, temporarily disable the affected server-side fetching capability in the Directorist plugin until a validated fix is deployed. Apply network-layer egress filtering on the WordPress host to block outbound requests to loopback, link-local (169.254.0.0/16), and RFC1918 ranges, which neutralizes the SSRF pivot regardless of plugin state. Enforce cloud metadata service protections such as IMDSv2 with hop-limit restrictions where the host runs in AWS or a similar provider.

2. Patch / upgrade steps. The vendor release line indicates the issue is addressed in Directorist 8.9.5. Upgrade the plugin to 8.9.5 or later after verifying the vendor advisory and testing in a staging environment. Because patch confidence is 0/4 and no tracked patch source is available, verify the fix independently before relying on it, and confirm the URL-validation behavior is present in the deployed build.

3. Long-term hardening. Implement URL allowlisting and scheme restriction (permit only http/https) for any server-side fetch, and resolve and reject private, loopback, and link-local destinations before the request is dispatched. Adopt least privilege for the WordPress host to limit the impact of successful SSRF, segment internal services away from public-facing web hosts, and monitor outbound connection attempts originating from web servers as a standing detection use case.

References

• NVD — CVE-2026-84046: https://nvd.nist.gov/vuln/detail/CVE-2026-84046
• MITRE CWE-918 Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• Directorist WordPress plugin (vendor product page): https://wordpress.org/plugins/directorist/
• OWASP Server-Side Request Forgery Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-84046 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog