CVE-2026-84150 is an authorization bypass vulnerability in the Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin versions prior to 8.9.5. The flaw arises from the plugin's failure to verify that the user targeted by a REST route is the same as the authenticated user making the request. As a result, any authenticated user with subscriber-level permissions can read and modify the saved favorites of other users, violating user data isolation.

An attacker with subscriber-level access can access and alter another user's saved favorites, potentially leading to unauthorized data exposure and modification within the application. This compromises user privacy and data integrity but does not indicate privilege escalation beyond subscriber-level access.

Upgrade the Directorist plugin to version 8.9.5 or later, where this authorization bypass vulnerability has been fixed. No other mitigation is indicated in the available data.