The Directorist plugin for WordPress prior to version 8.9.5 contains a flaw that allows an authenticated user with subscriber level access to read and modify another user's favorites through a REST API endpoint. This defect lets a malicious actor view and tamper with another member’s stored favorite items, exposing personal preference data and enabling unauthorized data manipulation. The weakness stems from a failure to validate that the target user of the REST route matches the authenticated caller, as identified by CWE-639. The impact is an information disclosure and integrity violation of user configuration data.

The vulnerability affects installations of the Directorist AI‑Powered Business Directory, Listings & Classified Ads WordPress plugin whose version is 8.9.5 or earlier. Exact corporate or hosting environments are not specified, but any WordPress site running a vulnerable Directorist plugin could be impacted.

The vulnerability has a CVSS score of 5.4, indicating moderate severity. An EPSS score of 0.0018 indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be logged in with a subscriber‑level role and to send requests to the affected REST endpoint. The attack vector is therefore authenticated REST API access, which is relatively easy for an insider or compromised user. While the flaw does not provide remote code execution or privilege escalation, the potential for data manipulation and privacy breach warrants prompt remediation.