EUVD-2026-100769
GHSA-g592-rv25-8rjh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister subscriber account on target site
-
DeliveryExtract exposed nonce from page script
-
ExploitSend crafted AJAX delete request
-
ExecutionBypass missing authorization check
-
ImpactDelete arbitrary listings of other users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with subscriber-level access or above on the target WordPress site - trivially obtainable where Directorist/WordPress open user registration is enabled, which is typical for public directory sites. No special plugin configuration or non-default mode is needed; the flaw is in the plugin's standard AJAX delete handler. The nonces (directorist_nonce and atbdp_nonce_js) provide no barrier because they are exposed to every logged-in user via wp_localize_script. Limiting factors: the attacker must be able to log in at all (so sites that disable public registration raise the bar to requiring any existing low-privilege account), and impact is restricted to deletion of business directory listings - there is no confidentiality exposure. |
| Impact | This is a genuine, actionable priority for any site running the Directorist plugin, though not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1 High) is internally consistent with the description: a network-reachable, low-complexity attack requiring only low privileges (subscriber account) and no user interaction, yielding high integrity and availability impact (arbitrary listing deletion) but no confidentiality loss. The low privilege barrier is meaningful but easily met - Directorist sites typically allow open user registration, so PR:L is effectively a near-unauthenticated condition in practice. No EPSS score, CISA KEV listing, or public POC was provided in the input; per precision rules this is 'no public exploit identified at time of analysis,' so there is no evidence of active or widespread exploitation yet. The core risk is data destruction (deletion of any user's listings regardless of publish/draft/private status), not data theft. The vulnerability is well-documented: Wordfence provides source-line references pinpointing the flawed AJAX handler and the nonce exposure via wp_localize_script, which raises confidence that a working exploit is trivial to construct even though none is cited. Overall: a real priority to patch promptly given low attack complexity and open-registration sites, but absent KEV/EPSS/POC signals it is not confirmed as being exploited in the wild. |
| Exploit ScenarioDerived | An attacker registers a free subscriber-level account on a Directorist-powered site (open registration is common for directory sites), harvests the directorist_nonce / atbdp_nonce_js values exposed to all logged-in users, and issues a crafted AJAX delete request targeting listing IDs owned by other users. Because the endpoint checks only the nonce and not the caller's ownership or capability, the listings - including published, draft, and private posts - are deleted. No public exploit code is identified at time of analysis, but the referenced source lines make a reliable exploit straightforward to build. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Authorization bypass in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 8.10.2.1) lets any authenticated user with subscriber-level access or higher delete arbitrary business directory listings, including listings owned by other users and posts in publish, draft, or private status, without any ownership or capability check. Scored 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), it is remotely reachable by an authenticated attacker (PR:L) with no user interaction and no confidentiality impact, but a high integrity and availability cost from destroyed content. The nonces that nominally guard the endpoint (directorist_nonce and atbdp_nonce_js) are exposed to every logged-in user through wp_localize_script, so they function as CSRF tokens only and are not an authorization barrier; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV). Practical exposure is greatest on public directory and classified-ad sites that permit open registration, since any visitor can self-register at subscriber level and then delete listings en masse.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - the WordPress.org Trac changeset 3730035 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3730035%40directorist&new=3730035%40directorist) contains the corrective code change, but no fixed tagged version is stated in the available data, so verify with the vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bd520915-2605-450a-9abd-423f1c226eb6?source=cve before relying on a specific release number; sites on 8.10.2.1 or earlier should update as soon as a patched build is confirmed, and until then the strongest compensating control is to deactivate the Directorist plugin entirely, trading loss of directory functionality for removal of the attack surface. If the plugin must stay live, disable public user registration and set the site's default new-user role to none, which removes the trivially obtainable subscriber account the exploit requires (trade-off: legitimate contributors and listing owners must be created by an administrator); audit and delete any unused or attacker-controlled subscriber accounts, since an existing low-privilege account still satisfies the prerequisite. Site operators can also block or filter requests to the plugin's listing-delete AJAX action at the web application firewall or reverse proxy, but this must be tuned carefully because it may break legitimate owner-initiated listing deletion from the front end. Because the operation is destructive rather than data-exfiltrating, verify that current backups of listings and posts are restorable and treat any unexplained listing deletion in logs as a probable exploitation attempt; additionally, watch for a plugin update notification and re-test after patching, as no patch version is independently confirmed in the supplied data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic Missing Authorization (CWE-862) in the plugin's AJAX delete handler rather than a memory-safety or injection bug. WordPress plugins commonly register AJAX actions (wp_ajax_* / wp_ajax_nopriv_*) and rely on a nonce check for protection; however, a nonce is an anti-CSRF token, not an authorization control, and it only proves the request originated from a rendered page for that user. Directorist embeds the endpoint's nonces, directorist_nonce and atbdp_nonce_js, into every page via wp_localize_script (see includes/asset-loader/localized_data.php), meaning any logged-in account, including a subscriber, can read them straight from the page source and replay the delete request. The handler code (includes/classes/class-ajax-handler.php around the delete-listings entry point) fails to perform the corresponding capability or post-ownership check, so the downstream listing deletion logic in includes/classes/class-listing-db.php and the role mapping in includes/classes/class-roles.php are reached with attacker-supplied listing identifiers. Because the vulnerability is entirely in the plugin's standard, default-configured AJAX path, no non-default setting or optional module is required to exploit it. References point to both the 8.8.7 and 8.7.3 tagged source trees, confirming the vulnerable code path has persisted across multiple releases; the affected package is identified by CPE cpe:2.3:a:wpwax:directorist:_ai-powered_business_directory,_listings_&_classified_ads (vendor wpwax).
Know when Directorist gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network AJAX endpoint (AV:N), no special conditions (AC:L), requires a subscriber account (PR:L), no interaction (UI:N); arbitrary deletion gives high integrity/availability impact and no data disclosure (C:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script.
Executive ViewAI
All versions of the Directorist WordPress plugin up to and including 8.10.2.1 contain an authorization bypass that allows any logged-in user - including the lowest-privilege subscriber account - to permanently delete business directory listings they do not own, including published, draft, and private content. Because self-registration is commonly enabled on directory sites, this effectively places a content-destruction capability in the hands of anyone who can create an account, creating both a data-loss and a reputational risk for the organization's public-facing listings. No vendor patch is currently available, so exposure persists until either the plugin is mitigated, restricted, or removed.
No vendor-released patch identified at time of analysis. Interim mitigations: block or restrict access to the Directorist deletion endpoints at the WAF/reverse-proxy layer; disable self-registration and remove or tightly control Subscriber-level accounts, since the flaw is reachable by any authenticated user with subscriber privileges or higher; take frequent verified backups of listing content to enable recovery from destructive actions; enable audit logging and alerting on bulk listing deletions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Directorist
View allThe Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leadi
The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessi
The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to chan
Remote unauthenticated attackers can escalate privileges to administrator level in Directorist Social Login WordPress pl
PHP Object Injection in the wpWax Directorist WordPress plugin (all versions through 8.8.2) lets remote attackers pass u
Path traversal in the Directorist WordPress plugin (versions 8.5 through before 8.9.3) allows subscriber-level authentic
The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to bo
The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor direc
The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including,
The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing an
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to
Missing post-ownership authorization in Directorist WordPress plugin before 8.9 allows any authenticated subscriber-leve
Exploit-DB