Description
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 8.1 – < 8.9.5 | 8.9.5 |
References
- https://wpscan.com/vulnerability/4311f66d-f032-4753-88e8-2afbd5d73ebc/ exploit vdb-entry technical-description