CVE-2026-77757: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Directorist: AI-Powered Business Directory, Listings & Classified Ads

CVE-2026-77757 is a CWE-22 path traversal vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions before 8.9.3. The plugin fails to properly sanitize user-supplied image references before using them as sources for file move operations. This flaw enables users with subscriber-level privileges to relocate arbitrary image files readable by the server into publicly accessible directories and delete the originals, potentially exposing sensitive files or disrupting content.

An attacker with subscriber-level access can move arbitrary server-readable image files to public directories and delete the originals. This may lead to unauthorized exposure of files and content disruption. The CVSS score is 5.4 (medium severity), indicating limited confidentiality and integrity impact without availability impact.

No official patch or remediation has been confirmed yet. Users should upgrade to version 8.9.3 or later once available, as the vulnerability affects versions before 8.9.3. Until then, restrict subscriber-level user permissions or monitor for suspicious file operations. Check the vendor advisory for updates on fixes.