CVE-2026-84046: CWE-918 Server-Side Request Forgery (SSRF) in Directorist: AI-Powered Business Directory, Listings & Classified Ads
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.
AI Analysis
Technical Summary
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 do not validate user-supplied URLs before fetching them server-side. This lack of validation enables users with subscriber role and above to cause the server to issue requests to internal addresses, constituting a Server-Side Request Forgery (CWE-918) vulnerability.
Potential Impact
Users with subscriber role or higher can exploit this vulnerability to make the server perform unauthorized requests to internal network resources. This could potentially expose internal services or data that are not otherwise accessible externally. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Upgrade the Directorist plugin to version 8.9.5 or later, where this vulnerability is fixed. Since the affected versions are explicitly prior to 8.9.5, applying the official update is the recommended remediation.
CVE-2026-84046: CWE-918 Server-Side Request Forgery (SSRF) in Directorist: AI-Powered Business Directory, Listings & Classified Ads
Description
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.
CVSS v3.1
Score 5.0medium
Affected software
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5 do not validate user-supplied URLs before fetching them server-side. This lack of validation enables users with subscriber role and above to cause the server to issue requests to internal addresses, constituting a Server-Side Request Forgery (CWE-918) vulnerability.
Potential Impact
Users with subscriber role or higher can exploit this vulnerability to make the server perform unauthorized requests to internal network resources. This could potentially expose internal services or data that are not otherwise accessible externally. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Upgrade the Directorist plugin to version 8.9.5 or later, where this vulnerability is fixed. Since the affected versions are explicitly prior to 8.9.5, applying the official update is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-01T04:15:02.651Z
- State
- PUBLISHED
Threat ID: 6ab36d3ff7a7c541065abca0
Added to database: 09/23/2026, 06:10:07 UTC
Last enriched: 09/23/2026, 06:33:02 UTC
Last updated: 09/24/2026, 01:57:05 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.