CVE-2026-84150
📛 CVE Title
Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint
Description
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- WPScan
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- 5.4 / 10 MEDIUM source: NVD
- CWE(s)
-
CWE-639 Authorization Bypass Through User-Controlled Key - Reserved
- 2026-09-01
- Published
- 2026-09-23 06:00 UTC
- Last updated
- 2026-09-23 10:57 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/84xxx/CVE-2026-84150.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-23 06:17:03 UTC
- NVD last modified
- 2026-09-23 18:13:31 UTC
- NVD CVSS v3.1
- 5.4 / 10 MEDIUM source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N- Exploitability subscore
- 2.8 / 10
- Impact subscore
- 2.5 / 10
- EPSS score
- 0.0018 (probability of exploitation in next 30 days)
- EPSS percentile
- 7.86% vs all CVEs — higher = more likely to be exploited, as of 2026-09-23
NVD-assigned CWE(s):
CWE-639
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-09-24 04:34 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85036 - Assigner
- WPScan
- Published
- Sep 23, 2026, 6:00:17 AM
- Updated
- Sep 23, 2026, 10:57:21 AM
- EUVD base score (CVSS 3.1)
-
5.4 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - EUVD-reported EPSS
- 0.1800
- Vendors
- Unknown
- Products
-
Directorist: AI-Powered Business Directory, Listings & Classified Ads (0 <8.9.5)
- Aliases
-
GHSA-qm62-48pg-2f99
ENISA description: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Unknown | Directorist: AI-Powered Business Directory, Listings & Classified Ads |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://wpscan.com/vulnerability/c8e6b49b-874f-41d6-bff4-58e9fe559463/ exploitvdb-entrytechnical-description
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://wpscan.com/vulnerability/c8e6b49b-874f-41d6-bff4-58e9fe559463/ contact@wpscan.com
Remediations (10)
-
web:sec.cloudapps.cisco.com
On September 16, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the ...
2026-09-24 11:49 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-09-24 11:49 UTC -
web:thecybersecguru.com
CVE - 2026 -85046 is a V8 type confusion zero-day already exploited in Chrome. Here's how the read/write primitive works, and how to patch immediately
2026-09-24 11:49 UTC -
web:www.aikido.dev
CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.
2026-09-24 11:49 UTC -
web:www.cisecurity.org
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete ...
2026-09-24 11:49 UTC -
web:www.malwarebytes.com
Update Chrome now: Two critical vulnerabilities could allow a malicious website to run code on your device.
2026-09-24 11:49 UTC -
web:www.mozilla.org
Mozilla Foundation Security Advisory 2026 -84 Security Vulnerabilities fixed in Firefox ESR 140.15 Announced September 1, 2026 Impact high Products Firefox ESR Fixed in Firefox ESR 140.15 # CVE - 2026 -75874: Sandbox escape in the Remote Settings Client component Reporter crixer Impact high References Bug 2039972 # CVE - 2026 -16365: Privilege escalation in the DOM: Workers component Reporter Khanh ...
2026-09-24 11:49 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-24 11:49 UTC -
web:www.securityweek.com
Google on Thursday rolled out fresh Chrome 152 security updates that resolve 12 vulnerabilities, including an exploited zero-day. Tracked as CVE - 2026 -85046, the high-severity bug is described as a type confusion issue in Chrome's V8 JavaScript and WebAssembly engine. It was reported by Salvatore Gulizia, who received a $1,000 bug bounty reward. "Google is aware that an exploit for CVE-2026 ...
2026-09-24 11:49 UTC -
web:www.techtimes.com
Chrome zero-day CVE - 2026 -85046 is under active attack as the sixth actively exploited Chrome vulnerability of 2026 . A type confusion flaw in Chrome's V8 JavaScript engine lets attackers run code ...
2026-09-24 11:49 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-84150.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-84150",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T10:43:00.544687Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T10:57:21.666Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Directorist: AI-Powered Business Directory, Listings & Classified Ads",
"vendor": "Unknown",
"versions": [
{
"lessThan": "8.9.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Revanth Hari Narayana Matte"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T06:00:17.146Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/c8e6b49b-874f-41d6-bff4-58e9fe559463/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Directorist < 8.9.5 - Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-84150",
"datePublished": "2026-09-23T06:00:17.146Z",
"dateReserved": "2026-09-01T07:33:49.420Z",
"dateUpdated": "2026-09-23T10:57:21.666Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}