Executive brief
Directorist is a WordPress plugin that powers business directory and classified ads functionality. The plugin fails to validate user permissions when creating orders through its REST API, allowing low-privilege users (subscribers and above) to create fake paid orders with arbitrary amounts and fraudulently attribute them to other users, enabling financial manipulation and account compromise.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the REST API orders endpoint. Any authenticated user with subscriber role or higher can invoke the endpoint without capability verification, allowing them to create order and payment records with arbitrary amounts and assign them to arbitrary users. The vulnerability requires network access and authentication but no additional user interaction; an attacker gains the ability to forge financial records and manipulate order attribution.
Affected products
- Directorist Directorist before 8.9.5
Timeline
- 2026-09-21: disclosed: Publicly published
- 2026-09-23: patched: Fixed in version 8.9.5
- 2026-09-23: advisory