The Directorist WordPress plugin before version 8.9.5 fails to verify user capabilities when creating orders through its REST API. This missing authorization (CWE-862) enables users with subscriber role or higher to create paid orders and payment records with arbitrary amounts and assign them to other users. The vulnerability affects versions from 8.9.1 up to but not including 8.9.5.

Users with minimal privileges (subscriber role and above) can create fraudulent paid orders and payment records with arbitrary amounts and assign them to other users. This could lead to unauthorized financial data manipulation within the plugin's order system. There is no indication of active exploitation in the wild.

Upgrade the Directorist plugin to version 8.9.5 or later, where this authorization issue is fixed. Since this is a self-hosted WordPress plugin, administrators must apply the update manually. Patch status is confirmed by the version range affected and the fixed version 8.9.5.