https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T02:01:17.229537+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-84066 CVE-2026-84066 — Directorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload 2026-09-29T02:01:22.110588+00:00

Affected: Unknown Directorist: AI-Powered Business Directory, Listings & Classified Ads

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.