CVE-2026-84026 is an information exposure vulnerability (CWE-200) in the Directorist WordPress plugin versions 8.1 up to but not including 8.9.5. The plugin fails to restrict access to a REST API endpoint that returns user records, enabling unauthenticated attackers to retrieve private contact information of registered users. No CVSS score is provided, and no known exploits are reported in the wild. The plugin is not a cloud service, and no official patch link is provided in the input data.

The vulnerability allows unauthorized disclosure of private user contact details, potentially compromising user privacy and enabling further targeted attacks or social engineering. There is no indication of active exploitation or additional impact such as privilege escalation or data modification.

Upgrade the Directorist plugin to version 8.9.5 or later, where this vulnerability is fixed. Since no official patch link is provided, users should verify the availability of the update from the plugin vendor or WordPress plugin repository. Until patched, restrict access to the vulnerable REST endpoint if possible.