Executive brief
The Directorist WordPress plugin, used to manage business directories and classified ads on websites, exposes a REST API endpoint that returns user records including private contact details without requiring authentication. An attacker can access this endpoint over the network to read the personal and contact information of all registered users without any credentials or user interaction.
Technical details
The plugin fails to implement access controls on a REST endpoint that returns user records (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). Unauthenticated attackers can send network requests to this endpoint and retrieve registered users' private contact details. The vulnerability affects versions 8.1 through 8.9.4 and is patched in version 8.9.5.
Affected products
- Directorist Directorist 8.1 through 8.9.4
Timeline
- 2026-09-21: disclosed
- 2026-09-23: patched: Version 8.9.5 released