Executive brief
The Directorist WordPress plugin, which powers business directories and classified ads listings, contains an authorization flaw that allows any authenticated subscriber to delete listings belonging to other users. An attacker with a basic subscriber account could remove business listings from the directory, disrupting the platform's operations and potentially causing data loss for business owners whose listings are deleted.
Technical details
The plugin fails to verify listing ownership before processing deletion requests via the remove_listing action, allowing authenticated subscribers and higher-privileged users to delete arbitrary listings. This is an incomplete fix of prior CVEs (CVE-2023-1889, CVE-2023-35052), with a separate unpatched deletion code path remaining vulnerable from version 3.1.0 through 8.9.4. The vulnerability requires authentication but no additional user interaction, and allows attackers to delete any listing in the system.
Affected products
- Directorist Directorist 3.1.0 through 8.9.4
Timeline
- 2026-09-21: disclosed
- 2026-09-23: patched: Version 8.9.5 fixes the vulnerability