CVE-2026-84066: CWE-862 Missing Authorization in Directorist: AI-Powered Business Directory, Listings & Classified Ads

The Directorist WordPress plugin prior to version 8.9 contains a missing authorization check (CWE-862) that permits users with the subscriber role or above to modify image metadata on posts they do not own. Specifically, the plugin does not verify ownership before writing uploaded file references to post metadata, enabling unauthorized modification of image metadata associated with other users' posts.

The vulnerability allows low-privileged users (subscriber role and above) to overwrite image metadata on posts belonging to other users. The CVSS score of 3.1 reflects a low impact, with no confidentiality or availability impact, only limited integrity impact. There is no indication of remote code execution or privilege escalation beyond the ability to alter metadata.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Users should monitor the vendor's announcements for updates and consider restricting subscriber-level permissions if possible until a fix is available.