File Manipulation Vulnerability in Directorist AI-Powered Business Directory Plugin
CVE-2026-77757

Currently unrated

Key Information:

Vendor

WordPress
Status
Directorist: Ai-powered Business Directory, Listings & Classified Ads
Vendor
CVE Published:
26 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-77757?

The Directorist plugin for WordPress, designed for business directory listings, can be exploited due to insufficient sanitization of user-supplied image references. This flaw permits users with subscriber-level accounts to manipulate server-readable image files, allowing them to move these files into publicly accessible directories and subsequently delete them from their original locations, posing significant security risks.

Affected Version(s)

Directorist: AI-Powered Business Directory, Listings & Classified Ads 8.5 < 8.9.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-77757 - Proof of Concept

References

https://wpscan.com/vulnerability/84a5b1f0-b5a7-4800-91ee-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Revanth Hari Narayana Matte
WPScan
.