Directorist
Monthly
Authorization bypass in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 8.10.2.1) lets any authenticated user with subscriber-level access or higher delete arbitrary business directory listings, including listings owned by other users and posts in publish, draft, or private status, without any ownership or capability check. Scored 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), it is remotely reachable by an authenticated attacker (PR:L) with no user interaction and no confidentiality impact, but a high integrity and availability cost from destroyed content. The nonces that nominally guard the endpoint (directorist_nonce and atbdp_nonce_js) are exposed to every logged-in user through wp_localize_script, so they function as CSRF tokens only and are not an authorization barrier; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV). Practical exposure is greatest on public directory and classified-ad sites that permit open registration, since any visitor can self-register at subscriber level and then delete listings en masse.
PHP Object Injection in the wpWax Directorist WordPress plugin (all versions through 8.8.2) lets remote attackers pass untrusted serialized data into a PHP deserialization sink, instantiating arbitrary objects that can trigger POP gadget chains for code execution, data theft, or site compromise. The flaw carries a critical 9.8 CVSS score with an unauthenticated network vector; it was disclosed by Patchstack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated attackers can escalate privileges to administrator level in Directorist Social Login WordPress plugin versions prior to 2.1.4 through incorrect privilege assignment during social authentication flows. Exploitation requires no authentication or user interaction, enabling complete site takeover via social login mechanisms. CVSS 9.8 (Critical) reflects network-based attack vector with no complexity barriers. No public exploit code or CISA KEV listing identified at time of analysis, but Patchstack reporting suggests vulnerability may be under researcher scrutiny.
Stored cross-site scripting in the Directorist WordPress plugin (AI-Powered Business Directory, Listings & Classified Ads) affects all versions up to and including 8.10.2.1, letting an attacker with a subscriber-level account inject arbitrary JavaScript through the 'phone' listing field that then executes in the browser of any user viewing the affected listing page. The weakness is reachable because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role by default, so a subscriber can submit and publish a listing with no administrator moderation; the primary real-world prerequisite is therefore a site that allows open or self-service user registration. Rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and tracked as CVE-2026-100185 by Wordfence, this is a moderate-severity issue that sits below top-priority status, and at the time of analysis there is no public exploit identified and no CISA KEV confirmation of active exploitation, though the low privilege bar makes it more practical than its modest impact metrics suggest.
Missing post-ownership authorization in Directorist WordPress plugin before 8.9 allows any authenticated subscriber-level user to overwrite image metadata on posts belonging to other users. The plugin fails to verify that the uploading user owns the target post before writing file references to its metadata, enabling cross-user content tampering limited to image attachment references. No public exploit confirmed via CISA KEV, but WPScan has published a proof-of-concept, and a vendor patch is available at version 8.9.
Path traversal in the Directorist WordPress plugin (versions 8.5 through before 8.9.3) allows subscriber-level authenticated users to relocate arbitrary server-readable image files into a publicly accessible directory and delete them from their original location. The flaw stems from unsanitized user-supplied image references passed directly to a file-move operation, exposing sensitive server files to unauthenticated public access after the move. Publicly available exploit code exists per WPScan reporting; however, EPSS sits at 0.19% (9th percentile), and the requirement for a subscriber-level account limits opportunistic mass exploitation.
Broken access control in wpWax Directorist WordPress plugin versions up to 8.5.10 allows unauthenticated remote attackers to modify data through incorrectly configured authorization checks. The vulnerability exploits missing permission validation on plugin functionality, enabling unauthorized state changes without authentication or user interaction. With EPSS at 0.02% and no public exploit code identified, real-world risk remains low despite network-accessible exploitation.
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.0.12. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Directorist - WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
A vulnerability in wpWax Directorist directorist.7.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable. No vendor patch available.
The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Authorization bypass in the Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 8.10.2.1) lets any authenticated user with subscriber-level access or higher delete arbitrary business directory listings, including listings owned by other users and posts in publish, draft, or private status, without any ownership or capability check. Scored 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), it is remotely reachable by an authenticated attacker (PR:L) with no user interaction and no confidentiality impact, but a high integrity and availability cost from destroyed content. The nonces that nominally guard the endpoint (directorist_nonce and atbdp_nonce_js) are exposed to every logged-in user through wp_localize_script, so they function as CSRF tokens only and are not an authorization barrier; no public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV). Practical exposure is greatest on public directory and classified-ad sites that permit open registration, since any visitor can self-register at subscriber level and then delete listings en masse.
PHP Object Injection in the wpWax Directorist WordPress plugin (all versions through 8.8.2) lets remote attackers pass untrusted serialized data into a PHP deserialization sink, instantiating arbitrary objects that can trigger POP gadget chains for code execution, data theft, or site compromise. The flaw carries a critical 9.8 CVSS score with an unauthenticated network vector; it was disclosed by Patchstack. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated attackers can escalate privileges to administrator level in Directorist Social Login WordPress plugin versions prior to 2.1.4 through incorrect privilege assignment during social authentication flows. Exploitation requires no authentication or user interaction, enabling complete site takeover via social login mechanisms. CVSS 9.8 (Critical) reflects network-based attack vector with no complexity barriers. No public exploit code or CISA KEV listing identified at time of analysis, but Patchstack reporting suggests vulnerability may be under researcher scrutiny.
Stored cross-site scripting in the Directorist WordPress plugin (AI-Powered Business Directory, Listings & Classified Ads) affects all versions up to and including 8.10.2.1, letting an attacker with a subscriber-level account inject arbitrary JavaScript through the 'phone' listing field that then executes in the browser of any user viewing the affected listing page. The weakness is reachable because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role by default, so a subscriber can submit and publish a listing with no administrator moderation; the primary real-world prerequisite is therefore a site that allows open or self-service user registration. Rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and tracked as CVE-2026-100185 by Wordfence, this is a moderate-severity issue that sits below top-priority status, and at the time of analysis there is no public exploit identified and no CISA KEV confirmation of active exploitation, though the low privilege bar makes it more practical than its modest impact metrics suggest.
Missing post-ownership authorization in Directorist WordPress plugin before 8.9 allows any authenticated subscriber-level user to overwrite image metadata on posts belonging to other users. The plugin fails to verify that the uploading user owns the target post before writing file references to its metadata, enabling cross-user content tampering limited to image attachment references. No public exploit confirmed via CISA KEV, but WPScan has published a proof-of-concept, and a vendor patch is available at version 8.9.
Path traversal in the Directorist WordPress plugin (versions 8.5 through before 8.9.3) allows subscriber-level authenticated users to relocate arbitrary server-readable image files into a publicly accessible directory and delete them from their original location. The flaw stems from unsanitized user-supplied image references passed directly to a file-move operation, exposing sensitive server files to unauthenticated public access after the move. Publicly available exploit code exists per WPScan reporting; however, EPSS sits at 0.19% (9th percentile), and the requirement for a subscriber-level account limits opportunistic mass exploitation.
Broken access control in wpWax Directorist WordPress plugin versions up to 8.5.10 allows unauthenticated remote attackers to modify data through incorrectly configured authorization checks. The vulnerability exploits missing permission validation on plugin functionality, enabling unauthorized state changes without authentication or user interaction. With EPSS at 0.02% and no public exploit code identified, real-world risk remains low despite network-accessible exploitation.
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.0.12. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Directorist - WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
A vulnerability in wpWax Directorist directorist.7.1. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable. No vendor patch available.
The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.