The Directorist plugin contains an unauthenticated REST endpoint that returns user records, exposing private contact details of registered users. This flaw allows an attacker to read sensitive personal information without needing credentials, compromising user confidentiality. The CVSS score of 5.3 places the vulnerability in the medium range, reflecting the privacy impact but limited on integrity or availability.

WordPress sites using the Directorist plugin version 8.1 through 8.9.4 are affected. The vendor is Directorist, known as the AI‑Powered Business Directory, Listings & Classified Ads plugin. No additional sub‑versions are listed, so any deployment relying on these release numbers may be vulnerable.

The exploit requires only a simple unauthenticated HTTP request to the REST endpoint, suggesting a straightforward attack vector over the public internet. Because the EPSS score is < 1% (0.00199), the exact likelihood of exploitation is low, but the lack of a KEV listing indicates no large‑scale public exploits have been observed. The medium CVSS score aligns with the privacy‑only impact, and the vulnerability remains unmitigated until the plugin is upgraded to 8.9.5 or later.