Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-09-04T07:17:10.940Z",
  "pubdate": "2026-09-04T07:17:10.940Z",
  "executiveSummary": "The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin, in versions prior to 8.9, contains an Insecure Direct Object Reference (IDOR) vulnerability related to post metadata management.\nThis vulnerability exists because the plugin fails to implement proper authorization checks to verify ownership of a post before updating its associated file references.\nAn attacker authenticated with at least a subscriber-level account can exploit this flaw to overwrite the metadata of posts belonging to other users or administrators.\nThe impact includes the ability to alter images associated with arbitrary business listings or classified ads, which can be leveraged for unauthorized content replacement, defacement, or social engineering campaigns.\nThis represents a significant integrity risk to the platform's content, as low-privileged users can manipulate data outside their designated scope of authority.",
  "technicalDetails": "The root cause of this vulnerability is an authorization bypass within the plugin's metadata processing logic. When a user initiates a request to update file references linked to a listing, the plugin fails to validate the current user's permissions against the target post's owner ID.\nThe vulnerability occurs because the plugin trusts the input parameters provided by the client without verifying whether the requesting user maintains legitimate control over the specific post ID being targeted. Consequently, the backend process proceeds to overwrite post metadata based on the attacker-supplied payload.\nThe attack flow begins when an authenticated attacker, holding at least subscriber privileges, interacts with the plugin's file upload or metadata update functionality. By intercepting or crafting a request targeting a post ID owned by another user, the attacker can submit malicious or redirected file references.\nBecause the server-side code does not perform an object-level authorization check—specifically failing to verify if the 'post_author' matches the current 'get_current_user_id()'—the database query executes successfully to update the post meta table.\nThis allows the attacker to inject arbitrary references into the metadata fields. If the system expects image URLs or attachments, the attacker can force the application to serve images of their choosing in place of the original assets, effectively hijacking the visual integrity of any listing on the platform.\nThis vulnerability is classified as an IDOR-based privilege escalation. While the attacker does not gain remote code execution, the impact on data integrity and content authenticity is high, as the application logic facilitates unauthorized modifications to posts that should remain protected from modification by non-privileged or non-author users.\nThe vulnerability affects all versions of Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin prior to 8.9 and is executable remotely by any authenticated user on the WordPress instance."
}