Description

Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Name Directory: from n/a through 1.34.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-05T09:17:07.933Z",
  "pubdate": "2026-10-05T09:17:07.933Z",
  "executiveSummary": "The Name Directory plugin for WordPress, developed by Jeroen Peters, contains a missing authorization vulnerability that allows unauthorized actors to bypass established access control security levels. This vulnerability exposes the application to unauthorized configuration manipulation or sensitive data access by bypassing security checks that should restrict functionality based on user roles.\nThe flaw affects all versions of Name Directory from the initial release through 1.34.2. By failing to validate the authorization level of the requester, the plugin permits users with insufficient privileges to perform actions reserved for administrators or higher-privileged accounts.\nThe risk implication is significant as it facilitates unauthorized administrative operations without prior authentication or privilege escalation. An attacker does not require specific elevated credentials to exploit this flaw, provided they can interact with the vulnerable endpoint. This vulnerability could lead to the unauthorized modification of directory settings, the exposure of sensitive directory contents, or the injection of malicious entries, effectively undermining the integrity and availability of the directory service.",
  "technicalDetails": "The vulnerability originates from a Missing Authorization flaw within the plugin's internal request handling mechanisms. In Name Directory versions up to 1.34.2, certain administrative endpoints or API handlers fail to implement server-side checks to verify if the incoming request originates from an authenticated user with sufficient administrative permissions.\nThe root cause is an insecure implementation of access control checks where sensitive actions are processed without verifying the user's role or capabilities before executing the requested operation. Specifically, the plugin logic assumes that if a request hits a specific backend route, it is legitimate, thereby bypassing the WordPress security model which relies on functions like current_user_can() to enforce security levels.\nThe attack flow proceeds as follows: 1) An unauthenticated or low-privileged attacker identifies the vulnerable endpoint responsible for directory management or configuration updates. 2) The attacker crafts a request, such as a GET or POST call, directed at the specific vulnerable controller or function within the plugin. 3) Due to the lack of an authorization check, the plugin's code processes the request, assuming the caller possesses the necessary privileges. 4) The server executes the function, leading to unauthorized state changes or data retrieval.\nBecause the system relies on incorrectly configured access control security levels, the exploit does not require complex privilege escalation techniques. Any user—or, depending on the server configuration, potentially an unauthenticated external actor—can trigger these functions if they have network access to the target WordPress installation.\nPost-exploitation, an attacker can manipulate the Name Directory configuration, which may lead to stored Cross-Site Scripting (XSS) if input validation is also insufficient, or the extraction of internal directory data that is intended to be protected by higher security levels. This flaw effectively turns restricted functionality into public-facing endpoints, drastically reducing the security posture of the WordPress environment by granting unauthorized control over the directory's behavioral parameters and stored information."
}