Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-23T06:17:02.667Z",
  "pubdate": "2026-09-23T06:17:02.667Z",
  "executiveSummary": "The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin contains an Improper Access Control vulnerability within its REST API implementation. This flaw permits unauthenticated remote attackers to query and retrieve private user records, including sensitive contact information, without requiring valid authentication or specific authorization tokens. The vulnerability affects all versions of the plugin prior to 8.9.5. By interacting with the exposed endpoint, an attacker can perform unauthorized data harvesting of the site's user database. This unauthorized access poses significant privacy risks, as personally identifiable information (PII) is exposed directly to the public internet. Given that no authentication is required, the barrier to exploitation is extremely low, allowing for automated scraping and large-scale data exfiltration of user accounts registered within the WordPress installation.",
  "technicalDetails": "The vulnerability originates from a failure to implement proper permission callbacks within the REST API route registration process in the Directorist plugin. In the WordPress REST API, route handlers must include a 'permission_callback' argument to ensure that the user requesting the data has the necessary capabilities to access the specific resource. In versions prior to 8.9.5, the plugin fails to define or correctly enforce this callback for the endpoint responsible for user record retrieval.\nThe exploitation process follows a predictable pattern: an attacker targets the specific REST API endpoint registered by the Directorist plugin, typically located under the '/wp-json/' namespace. Because the endpoint does not perform an authentication check or a 'current_user_can()' authorization verification, the request is processed by the plugin's controller regardless of the requester's session state. The controller then executes a database query—typically involving 'get_users()' or a direct SQL query—to fetch user metadata from the 'wp_users' and 'wp_usermeta' tables.\nThe attack flow is as follows: 1) The attacker identifies the target WordPress site using the Directorist plugin. 2) The attacker crafts an HTTP GET request directed at the exposed REST API route. 3) The server, lacking access control, executes the internal function intended for authorized users. 4) The plugin serializes the user object, which often includes fields such as email addresses, display names, and potentially other sensitive contact information stored in the user profile. 5) The server returns this sensitive payload in JSON format to the attacker. This process can be easily automated using simple scripting tools like 'curl' or 'python-requests' to iterate through user IDs or perform batch dumps of the user registry. The impact extends beyond simple data leakage; the exposure of email addresses facilitates targeted phishing campaigns, credential stuffing, and social engineering attacks against the site's user base. The root cause is categorized as an authorization bypass resulting from insecure API design, specifically the omission of security checks on sensitive data-fetching endpoints."
}