Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-23T06:17:02.840Z",
  "pubdate": "2026-09-23T06:17:02.840Z",
  "executiveSummary": "The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin contains an improper authorization vulnerability within its REST API endpoints.\nThis security flaw arises due to the failure of the application to enforce capability checks when processing requests for order creation.\nThe vulnerability allows authenticated users, specifically those assigned the subscriber role or higher, to invoke functions reserved for administrative or system-level processes.\nThe primary risk implications involve the manipulation of financial and order-related records within the WordPress database.\nBy bypassing authorization controls, an attacker can create fraudulent paid orders and payment entries with arbitrary financial amounts.\nThese malicious records can be programmatically attributed to other users, potentially leading to accounting discrepancies, unauthorized service access, or fraudulent billing cycles.\nThe vulnerability is present in versions of the plugin prior to 8.9.5.\nExploitation requires the attacker to possess an active subscriber-level account, making the attack surface accessible to any registered user on the WordPress installation.",
  "technicalDetails": "The root cause of this vulnerability is a lack of rigorous server-side authorization checks within the Directorist REST API implementation. Specifically, the API endpoint responsible for order and payment record creation fails to validate the current user's capabilities against the required permissions before executing the backend logic.\nIn the WordPress environment, REST API endpoints are typically protected via the 'permission_callback' parameter, which must explicitly verify that the requesting user holds the necessary 'edit_posts', 'manage_options', or equivalent administrative capabilities. In this instance, the plugin's code permits any user with a 'subscriber' role—the lowest possible privilege level—to successfully trigger the order creation workflow.\nThe attack flow begins when an authenticated subscriber sends a crafted HTTP POST request to the vulnerable REST API endpoint associated with Directorist payment processing. Because the application logic does not perform a capability check during the request handling, it proceeds to instantiate and save a new order object to the database.\nThe attacker can manipulate the request parameters to specify an arbitrary monetary amount, effectively bypassing standard payment gateway verification. Furthermore, the attacker can supply user identifiers in the request to associate these forged orders with arbitrary system users, including administrators.\nBy manipulating these fields, the attacker can force the system to recognize fraudulent transactions. This can lead to various post-exploitation impacts, including the illicit acquisition of digital goods or services if the plugin's logic automatically grants permissions based on order status, or the corruption of platform revenue tracking and financial reporting.\nThe vulnerable component resides in the plugin's REST API controller logic responsible for order lifecycle management. Because this is an authenticated REST API vulnerability, the attacker must have a registered account on the target WordPress site. The exposure is network-wide, as REST API calls are processed over standard HTTP/HTTPS protocols, and the vulnerability is effectively triggered through standard JSON-formatted API payloads."
}