Medium severity5.4NVD Advisory· Published Aug 26, 2026· Updated Aug 26, 2026
CVE-2026-77757
CVE-2026-77757
Description
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <8.9.3
Patches
Vulnerability mechanics
References
1News mentions
2- Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)Wordfence Blog · Sep 3, 2026
- WordPress: 25 Plugins and Themes Hit by Vulnerabilities, Including Critical RCE and File Upload FlawsVypr Intelligence · Aug 26, 2026