Directorist WordPress plugin: Missing authorization allows deletion of listings
Summary
The Directorist WordPress plugin up to and including version 8.10.2.1 does not verify authorization for an AJAX action that deletes business directory listings. An authenticated user with at least subscriber rights can delete listings owned by other users, including listings in publish, draft and private status. The nonces that protect the endpoint are exposed to all logged-in users and therefore do not prevent the attack.
Affected
- Directorist (wpWax), all versions up to and including 8.10.2.1
- Vulnerable condition: attacker needs a logged-in account with subscriber role or higher
Fixed in
Unknown. No vendor advisory or fixed version tied to this CVE was confirmed. The first fixed version must be verified against the referenced changeset before relying on it.
Workaround
- No vendor-published workaround found.
- Restrict or disable subscriber self-registration and remove unused subscriber accounts.
Exploitation
- Not listed in CISA KEV (secondary source).
- EPSS 0.00539 per NVD mirror.
- No public proof of concept found; no known exploitation in the wild.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Update Directorist to the latest 8.10.x release and confirm the fix in the referenced changeset.
- Restrict open registration and review subscriber accounts.
- Monitor listing deletion events and keep a current backup of the listings database.
- Prioritise this on sites with open registration or many subscriber accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence www.wordfence.com
- WordPress trac changeset 3730035 plugins.trac.wordpress.org
- NVD mirror (vulners) vulners.com
- Patchstack Directorist vulnerabilities patchstack.com
- Directorist on wordpress.org wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:12.
Original description (NVD)
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script.
NVD references (14)
- https://plugins.trac.wordpress.org/browser/directorist/tags/8.7.3/includes/asset-loader/localized_data.php#L92
- https://plugins.trac.wordpress.org/browser/directorist/tags/8.7.3/includes/classes/class-ajax-handler.php#L12…
- https://plugins.trac.wordpress.org/browser/directorist/tags/8.7.3/includes/classes/class-ajax-handler.php#L12…
- https://plugins.trac.wordpress.org/browser/directorist/tags/8.7.3/includes/classes/class-ajax-handler.php#L24
- https://plugins.trac.wordpress.org/browser/directorist/tags/8.7.3/includes/classes/class-listing-db.php#L101
- https://plugins.trac.wordpress.org/browser/directorist/tags/8.7.3/includes/classes/class-roles.php#L142
- https://plugins.trac.wordpress.org/browser/directorist/tags/8.8.7/includes/asset-loader/localized_data.php#L92
- https://plugins.trac.wordpress.org/browser/directorist/tags/8.8.7/includes/classes/class-ajax-handler.php#L12…
- https://plugins.trac.wordpress.org/browser/directorist/tags/8.8.7/includes/classes/class-ajax-handler.php#L12…
- https://plugins.trac.wordpress.org/browser/directorist/tags/8.8.7/includes/classes/class-ajax-handler.php#L24
- https://plugins.trac.wordpress.org/browser/directorist/tags/8.8.7/includes/classes/class-listing-db.php#L101
- https://plugins.trac.wordpress.org/browser/directorist/tags/8.8.7/includes/classes/class-roles.php#L142
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3730035%40directorist&new=3730035%40directorist
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bd520915-2605-450a-9abd-423f1c226eb6?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.