CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.0.12 via the /wp-json/directorist/v1/users/ endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including including usernames, email addresses, names, and more information about users.
Explanation of Vulnerability in Simple Terms
Directorist versions up to 8.0.12 expose sensitive information through improper access controls. An attacker can read private data without authentication by making direct requests to the application. The vulnerability affects confidentiality but not data integrity or availability. Site administrators should update to a version newer than 8.0.12.
What an attacker can do
Read sensitive information without logging in.
Potential impact on your site
Visitor data, user information, or other private content may be exposed to unauthenticated attackers.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
