Description

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-23T06:17:03.173Z",
  "pubdate": "2026-09-23T06:17:03.173Z",
  "executiveSummary": "The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin contains an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient authorization checks within its REST API implementation.\nThis vulnerability exists in versions prior to 8.9.5 and affects the mechanism responsible for handling user-saved favorites.\nBy failing to validate that the authenticated caller is authorized to access or modify the specific user record requested in a REST route, the plugin allows any authenticated subscriber-level user to perform unauthorized actions on other users' data.\nThe impact is significant, as it permits the unauthorized disclosure of private information (viewing favorites) and unauthorized data modification (altering favorites) across the user base.\nExploitation requires a valid subscriber account on the WordPress installation, making this a cross-user data exposure flaw. Successful exploitation results in the compromise of user-specific preferences and sensitive interaction history stored within the plugin.\nOrganizations using this plugin are at risk of data leakage and manipulation, necessitating immediate remediation to maintain data integrity and privacy.",
  "technicalDetails": "The vulnerability resides within the REST API endpoint logic of the Directorist plugin. The root cause is an improper authorization check that fails to correlate the user ID supplied in the API request with the identity of the authenticated user session.\nIn a secure implementation, REST routes that handle user-specific data must perform an access control check to ensure the 'current_user_id' matches the target object's owner ID. In this instance, the plugin's API handler accepts user identifier parameters without verifying the requester's authority over the target resource.\nThe attack flow begins when an authenticated subscriber identifies a REST API route used by the plugin to read or update the 'favorites' list for a specific user. Because the endpoint does not perform an identity verification check, the attacker can submit a modified request—typically by altering a 'user_id' parameter in the JSON payload or the URL query string—to reference a victim’s unique identifier.\nUpon receiving the malicious request, the server executes the requested operation (either retrieval or modification) as if the attacker has the permission to manage the target user's data. Since the plugin fails to enforce 'current_user_can()' or equivalent capability checks against the target object, the operation succeeds.\nThe affected component is the REST API controller logic responsible for processing interactions with the user favorites system. This vulnerability is accessible via the network, provided the attacker has obtained a legitimate subscriber-level account, which is a common privilege level for WordPress sites that allow public registration.\nThe post-exploitation impact includes the ability to view, add, or remove items from any other registered user's list of business favorites. This leads to a total compromise of user-level data confidentiality and integrity regarding the plugin's core functionality. Given the nature of business directory sites, this data could include preferences, interest profiling, and commercial activity tracking, which could be weaponized for targeted phishing or competitive intelligence gathering."
}