Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-09-23T06:17:02.967Z",
  "pubdate": "2026-09-23T06:17:02.967Z",
  "executiveSummary": "The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin contains a Server-Side Request Forgery (SSRF) vulnerability. This flaw arises from insufficient validation of user-supplied URLs prior to server-side resource fetching.\nThe vulnerability affects all versions of the plugin prior to 8.9.5. By exploiting this issue, a remote attacker with a minimum of subscriber-level privileges can force the underlying web server to initiate arbitrary HTTP requests.\nThis allows the attacker to interact with internal network resources, potentially bypassing perimeter firewalls, accessing sensitive internal services (such as metadata services in cloud environments), or scanning internal network infrastructure.\nThe risk is categorized as high, as it enables an authenticated user to perform unauthorized actions on behalf of the server, effectively bridging the security gap between the public-facing application and the private internal network.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of a remote resource-fetching mechanism within the Directorist plugin. The application logic fails to perform adequate input sanitization or validation on user-provided URL parameters before passing them to server-side request functions (such as wp_remote_get or similar HTTP request handlers).\nBecause the server-side code does not implement an allowlist of permitted hosts or apply restrictions against internal IP addresses (e.g., 127.0.0.1, 169.254.169.254, or RFC 1918 private address ranges), an attacker can supply crafted URLs that point to internal targets.\nThe exploitation flow begins when an authenticated subscriber submits a request to the vulnerable endpoint within the plugin that triggers the remote fetch function. By supplying a malicious URL in the request parameters, the attacker instructs the WordPress server to perform an out-of-band GET request. The server then acts as a proxy, sending the request to the target destination provided by the attacker.\nSuccessful exploitation grants the attacker the ability to interact with services running on localhost or within the internal network that are not exposed to the internet. This includes, but is not limited to, interacting with cloud instance metadata services (IMDS), monitoring interfaces, database administration panels, or internal APIs that may lack secondary authentication.\nFurthermore, the response from these internal requests may be reflected or processed by the plugin, potentially leading to information disclosure. The vulnerability is restricted to users with subscriber-level access and above, limiting the attack surface to authenticated users, which still represents a significant security concern in multi-user WordPress installations."
}