Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to 8.9 are not affected. The endpoint was scoped correctly in 8.8.1 and the unscoped behaviour was reintroduced in 8.9.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-23T06:17:01.933Z",
  "pubdate": "2026-09-23T06:17:01.933Z",
  "executiveSummary": "The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin contains an Improper Authorization vulnerability within its REST API collection endpoints.\nThis vulnerability allows authenticated users with minimal privileges, such as subscriber-level accounts, to bypass intended access controls and exfiltrate sensitive data.\nThe scope of the impact includes the unauthorized exposure of private customer order history and detailed payment records.\nThe vulnerability stems from a failure to correctly enforce scoping restrictions on specific REST API endpoints, which essentially treats unauthorized requests as authenticated administrative queries.\nThe issue affects versions of the plugin prior to 8.9.5, with a regression occurring in version 8.9.1 after a previous fix in version 8.8.1.\nThis flaw presents a significant risk to data privacy and regulatory compliance, as any attacker with basic subscriber-level authentication can systematically harvest sensitive financial and transactional information across the entire WordPress installation without further escalation of privileges.",
  "technicalDetails": "The vulnerability is characterized as an Insecure Direct Object Reference (IDOR) or a broken access control issue resulting from improperly scoped REST API collection endpoints within the Directorist plugin.\nThe root cause is a failure in the API endpoint implementation to validate the permissions or ownership of the requesting user when querying transaction and order data. In a secure implementation, REST endpoints handling sensitive data must verify that the requesting user's session identifier has the required capabilities (e.g., 'manage_options' or 'edit_shop_orders') to view records belonging to other users.\nIn the affected versions (prior to 8.9.5, specifically including the regression introduced in 8.9.1), the endpoint fails to restrict the database query results based on the `user_id` or equivalent ownership attribute. Consequently, when a subscriber-level user requests the endpoint, the application executes a query that returns the entire collection of orders and payment logs rather than filtering the results to only those associated with the authenticated user.\nThe attack flow proceeds as follows: First, an attacker authenticates to the target WordPress site using a low-privileged account (Subscriber). Second, the attacker performs reconnaissance on the plugin's REST API structure, typically by intercepting requests via a proxy like Burp Suite or examining JavaScript files to identify registered REST routes. Third, the attacker initiates a GET request to the vulnerable endpoint associated with order or payment collection. Because the endpoint lacks server-side permission checks, the backend API handler retrieves the complete database dataset associated with these objects and returns the response in a JSON payload. Finally, the attacker parses the JSON response to capture sensitive customer data, including order IDs, payment statuses, and potentially personally identifiable information (PII).\nThis vulnerability persists across the network as long as the REST API is exposed. The absence of adequate capability checks means that the API essentially functions as an unauthenticated or low-privilege administrative tool. Exploitation is trivial and requires no specialized tools other than a standard HTTP client. Post-exploitation impact involves full exposure of the platform's transactional history, leading to potential data breaches, privacy violations, and long-term reputational damage to the service provider."
}