Improper Ownership Verification in Directorist Plugin for WordPress
CVE-2026-84098

Currently unrated

Key Information:

Vendor

WordPress
Status
Directorist: Ai-powered Business Directory, Listings & Classified Ads
Vendor
CVE Published:
23 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-84098?

The Directorist plugin for WordPress, specifically versions prior to 8.9.5, contains an improper access control flaw that allows authenticated users with Subscriber-level permissions and above to delete arbitrarily chosen listings without verifying proper ownership. This weakness poses a significant risk as it enables attackers to erase listings that belong to others. This is an ongoing concern, as it junctions with prior unaddressed vulnerabilities, indicating that the issue could lead to further unauthorized modifications of user-generated content.

Affected Version(s)

Directorist: AI-Powered Business Directory, Listings & Classified Ads 3.1.0 < 8.9.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-84098 - Proof of Concept

References

https://wpscan.com/vulnerability/b5f83718-84ff-49e4-9ad7-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Artus KG
WPScan
.