CVE-2026-77757— Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission
Quick assessment
Affected
Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Directorist: AI-Powered Business Directory, Listings & Classified Ads 插件（版本号低于 8.9.3）中，存在一个漏洞，该漏洞在将用户提供的图像引用用作文件移动操作的源之前未进行适当的过滤或清理。这使得拥有订阅者级别账户的用户可以将任意服务器可读的图像文件移动到公开可访问的目录中，并可以将其从原始位置删除。
Possible ATT&CK Techniques 2 AI
T1083 · File and Directory Discovery T1048 · Exfiltration Over Alternative Protocol
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77757
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Directorist 8.5 - 8.9.2 - Subscriber+ Arbitrary Image Move via REST v2 Listing Submission
Source: CVE Program / CVE List V5
Vulnerability Description
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 8.5 ~ 8.9.3 | - |
|
II. Public POCs for CVE-2026-77757
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77757
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-77757 (1)
-
🔗 Directorist 8.5 – 8.9.2 – Subscriber+ Arbitrary Image Move via REST v2 Listing Submission | CVE 2026-77757 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-08-26 · 27 CVEs total
| CVE-2026-19226 | Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Eff | |
| CVE-2026-78146 | Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Pag | |
| CVE-2026-77790 | RegistrationMagic < 6.0.9.4 - Admin+ SQLi via 'rm_sortby' Parameter | |
| CVE-2026-77754 | Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_ap | |
| CVE-2026-77789 | Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via | |
| CVE-2026-77758 | Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription | |
| CVE-2026-77695 | Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and | |
| CVE-2026-74929 | WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modi | |
| CVE-2026-74930 | WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR | |
| CVE-2026-77693 | Order Tip for WooCommerce < 1.6.0 - Shop Manager+ Arbitrary File Deletion via delete_expor | |
| CVE-2026-77694 | Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token | |
| CVE-2026-75797 | AI Engine 3.3.3 - 3.7.1 - Subscriber+ Arbitrary File Read via 'url' Parameter | |
| CVE-2026-75798 | AI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistan | |
| CVE-2026-14212 | Amelia Pro < 9.8 - Provider+ Arbitrary Provider Password Update via IDOR | |
| CVE-2026-19220 | Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalati | |
| CVE-2026-19718 | BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connectio | |
| CVE-2026-74928 | WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello | |
| CVE-2026-74851 | Pods < 3.3.9.1 - Author+ RCE via Shortcode Display Callback | |
| CVE-2026-14550 | WPCafe < 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing Authorization | |
| CVE-2026-14216 | Amelia < 2.4.7 - Unauthenticated Notification Queue Dispatch |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
-
CVE-2025-12174
Directorist: AI-Powered Business Directory Plugin with Class -
CVE-2025-10488
Directorist: AI-Powered Business Directory Plugin with Class -
CVE-2025-2224
Directorist <= 8.2 - Missing Authorization to Unauthenticate -
CVE-2025-1570
Directorist: AI-Powered Business Directory Plugin with Class -
CVE-2024-12041
Directorist – AI-Powered WordPress Business Directory Plugin
Same vendor: Unknown
-
CVE-2026-78146
Noptin < 4.3.3 - Unauthenticated Subscriber PII and confirm_ -
CVE-2026-77695
Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest -
CVE-2026-77758
Stripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticate -
CVE-2026-77789
Stripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer -
CVE-2026-77754
Kirki < 6.0.14 - Unauthenticated User and Comment Author Ema
V. Comments for CVE-2026-77757
No comments yet