Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-23T06:17:03.070Z",
  "pubdate": "2026-09-23T06:17:03.070Z",
  "executiveSummary": "The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin contains a critical insecure authorization vulnerability within its listing deletion functionality. Specifically, the plugin fails to perform adequate access control checks to verify that the user initiating a deletion request is the authorized owner of the listing or possesses sufficient administrative privileges.\nThis vulnerability is an incomplete remediation of CVE-2023-1889 and CVE-2023-35052, as an alternative code path still permits unauthorized object manipulation. The flaw affects all plugin versions from 3.1.0 through 8.9.4. An authenticated attacker with Subscriber-level access or higher can leverage this defect to delete arbitrary listings from the WordPress database, including those owned by other users or administrators. The risk implication is significant, as it allows for widespread denial-of-service against business directory content and potential disruption of site operations. Exploitation is straightforward, requiring only an authenticated session on the WordPress site and the identification of the target listing ID.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authorization checks within the plugin's listing management API endpoints. While the application attempts to secure listing operations, it fails to enforce an ownership verification logic on specific deletion-handling functions. This manifests as an Insecure Direct Object Reference (IDOR) or a Broken Access Control scenario, where the backend code accepts a request to delete a listing based solely on a provided 'post_id' or 'listing_id' parameter, without validating the relationship between the current user session (WP_User) and the object being acted upon.\nSpecifically, this is identified as an incomplete patch for previously reported CVE-2023-1889 and CVE-2023-35052. The plugin developers secured one execution path for deletion, but left a secondary, legacy, or alternate functional path reachable by users. Since the application does not verify the 'post_author' metadata or check for the 'manage_options' capability before executing the database deletion command (such as 'wp_delete_post' or a direct SQL query), the authorization boundary is non-existent for low-privileged users.\nAttack flow for this vulnerability involves: 1) An attacker authenticating as a Subscriber user; 2) The attacker identifying the target listing's ID via the frontend directory browser; 3) The attacker crafting a malicious HTTP POST request targeting the vulnerable deletion endpoint, including the valid listing ID in the parameters; 4) The server-side logic processes the request, failing to verify ownership or capability, and successfully deletes the record from the 'wp_posts' table. This causes the target listing to be permanently moved to the trash or permanently deleted, depending on configuration.\nBecause the plugin versions 3.1.0 through 8.9.4 share this flaw across multiple API entry points, an attacker can bypass the intended security restrictions systematically. The vulnerability is exploitable via standard web traffic over HTTP/HTTPS, requiring no specialized administrative access. The post-exploitation impact is limited to the deletion of directory assets; however, the ease of execution allows for automated mass deletion, which represents a severe threat to the integrity and availability of the directory service platform."
}