Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files into a publicly accessible directory, and to delete them from their original location.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-26T06:16:29.610Z",
  "pubdate": "2026-08-26T06:16:29.610Z",
  "executiveSummary": "The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin, specifically versions prior to 8.9.3, contains a critical security vulnerability involving improper input validation during file handling operations.\nThe vulnerability is classified as an Arbitrary File Move/Delete flaw, which allows authenticated users with subscriber-level privileges to manipulate file system contents.\nBy failing to sanitize user-supplied image references, the plugin facilitates a path traversal-like operation where server-readable image files can be relocated to publicly accessible directories or deleted from their original locations.\nThis unauthorized file system interaction poses significant risks, including the potential exposure of sensitive data, service disruption through the deletion of critical application files, and the possibility of bypassing security restrictions by moving configuration or media files into accessible locations.\nSuccessful exploitation requires minimal authentication (subscriber account) and does not necessitate complex social engineering, making it a viable vector for malicious actors seeking to compromise site integrity or extract sensitive information stored in image-based artifacts.",
  "technicalDetails": "The root cause of this vulnerability lies in the plugin's failure to perform adequate input validation and path sanitization on image reference parameters provided during the file handling lifecycle.\nSpecifically, the application logic processes a user-supplied identifier intended to locate an image on the server. Because the plugin does not enforce strict path restrictions or canonicalization, the backend function responsible for file movement interprets this user-supplied input as a trusted file path.\nAn attacker with a subscriber-level account can supply a crafted input that points to an arbitrary file on the server. When the application executes the file move operation, it shifts the target file from its source directory to a destination defined by the attacker, which is commonly a publicly accessible folder within the web root.\nThe attack flow proceeds as follows: 1. The attacker identifies a target file (e.g., sensitive images or system-related resources) accessible to the web server's user context. 2. The attacker triggers the vulnerable function within the Directorist plugin, supplying the path of the target file via the image reference parameter. 3. The plugin executes an internal move/rename command, effectively relocating the target file to a directory where it can be retrieved via an HTTP GET request.\nFurthermore, the logic often results in the original file being unlinked from its primary location during the move process. This side effect allows an attacker to perform a permanent deletion of server files, leading to denial-of-service conditions or the corruption of WordPress site functionality.\nThe vulnerability is present in all versions prior to 8.9.3. It is reachable via the authenticated WordPress environment. Because no server-side checks verify that the file being moved is owned by the user or resides within permitted directories, the vulnerability effectively provides the attacker with file system write and delete privileges limited only by the permissions of the web server user account (typically www-data).\nPost-exploitation impact includes unauthorized data exfiltration of publicly accessible files, potential configuration file exposure if non-image files are accessible under the same file processing logic, and intentional disruption of the business directory service by removing essential site assets."
}