CVE-2025-12174
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Directorist plugin for WordPress (versions up to and including 8.5.2) lacks capability checks on the 'directorist_prepare_listings_export_file' and 'directorist_type_slug_change' AJAX actions. An authenticated attacker with Subscriber-level access or above can export listing details and change the directorist slug.
Risk Assessment
Unauthorized access to listing data and modification of directory configuration by low-privileged users.
Recommendation
Update the Directorist plugin to a version newer than 8.5.2 or apply the vendor patch. Restrict user roles if updating is not possible.
Other vulnerabilities in Directorist WordPress plugin
See all- CVE-2026-84150Medium
The Directorist WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites. This allows any authenticated user with subscriber-level access to view and alter another user's favorites.
- CVE-2026-84098Medium
The Directorist WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it. This allows authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.
- CVE-2026-84046Medium
The Directorist WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side. This allows users with the subscriber role and above to make the server issue requests to internal addresses.
Original NVD description (English source)
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'directorist_prepare_listings_export_file' and 'directorist_type_slug_change' AJAX actions in all versions up to, and including, 8.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export listing details and change the directorist slug.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS