Description
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users.
This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Directorist: AI-Powered Business Directory, Listings & Classified Ads | 3.1.0 – < 8.9.5 | 8.9.5 |
References
- https://wpscan.com/vulnerability/b5f83718-84ff-49e4-9ad7-395cc0ab494b/ exploit vdb-entry technical-description