External risk intelligence

Directorist Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-59518

The vulnerability affects a WordPress plugin, which is commonly deployed as an internet-facing web application. Since the plugin is part of the public web surface and intended to be accessible to site visitors, the attack surface is considered likely to be reachable from the internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Directorist plugin for WordPress, allowing for the injection of malicious code. This could potentially lead to a complete compromise of affected systems.

Untrusted data can be injected into the plugin.
Affects common internet-facing WordPress sites.
Confirm if Directorist is in use and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to a vulnerable Directorist plugin installation. If the plugin processes this data without proper validation, it can lead to object injection, potentially allowing the attacker to execute arbitrary code on the server. This could result in a complete compromise of the website.

No special access required.
Crafted data sent to plugin.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject dangerous objects into the Directorist plugin when it processes untrusted data. When supported by the advisory, this could lead to the execution of arbitrary code or manipulation of the affected WordPress site's behavior and data.

System data and configurations could be affected.
Untrusted data processed by the plugin could lead to injection.
Compromise of website integrity and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Directorist WordPress plugin likely falls under the purview of the website's application owners and potentially the platform or infrastructure teams responsible for the WordPress environment. The first practical step is to identify all instances of the Directorist plugin across your web properties, confirm their exposure to the internet, and determine the business criticality of each instance. This will inform the prioritization of remediation efforts and help pinpoint the accountable owner for each affected site before planning the appropriate response.

Identify affected WordPress sites.
Verify plugin reachability and business impact.
Plan targeted remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Directorist plugin for WordPress?

Directorist is a WordPress plugin used to build directory and classifieds websites. It enables site owners to create listings, manage business directories, and process user-submitted content. Because it manages dynamic data inputs like user profiles and directory entries, it interacts directly with the site's database and processing logic.

What does CVE-2026-59518 mean by Object Injection?

This vulnerability is classified as CWE-502, Deserialization of Untrusted Data. In plain English, the plugin incorrectly processes data sent from outside sources, allowing it to be turned into executable objects. This essentially tricks the application into running unauthorized commands or manipulating internal data structures, bypassing typical security controls.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending specifically crafted, malicious data to the plugin. If the plugin processes this input without validating it first, the injection occurs. Simply visiting the site or browsing existing directory listings does not trigger the bug; the attacker must deliberately submit or transmit the malformed data packet to the plugin's processing endpoints.

Do I need to worry about this if my site is not public?

Halo Surface Signal indicates that because Directorist is a plugin intended for public directory listings, it is typically deployed on internet-facing web applications. If your instance is strictly internal and unreachable from the public web, your risk profile is different, though you should still verify if any automated processes or internal users could submit the malicious data payloads required to trigger the issue.

How should I respond to CVE-2026-59518?

Start by auditing your WordPress environment to create a complete inventory of all sites running the Directorist plugin. Once you have a list, prioritize these sites based on their business criticality and whether they are exposed to the public internet. After identifying these assets, coordinate with your web administration teams to plan and apply the necessary security updates to address the vulnerable component.

References

patchstack.com/database/Wordpress/Plugin/directorist/vulnerability/w…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.