Unrated severityNVD Advisory· Published Sep 4, 2026

Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload

CVE-2026-84066

Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Directoristllm-fuzzy
Range: <8.9
Package: https://wordpress.org/plugins/directorist

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/99d990ce-aef3-404d-8ce0-803215fbf0bb/mitreexploitvdb-entrytechnical-description

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000