CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
What the vulnerability does
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficient file path validation in the add_listing_action AJAX action in all versions up to, and including, 8.4.8. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
Directorist versions up to 8.4.8 contain a path traversal vulnerability that allows authenticated users to modify or delete arbitrary files on the server. An attacker with low-level access can bypass file system restrictions and manipulate critical site files, potentially compromising site integrity and availability.
What an attacker can do
Modify or delete arbitrary files on the server, including core site files and configuration.
Potential impact on your site
Site files and data can be corrupted or deleted by authenticated users, leading to site malfunction or data loss.
Conditions required to exploit
Attacker must have a low-privilege user account on the site (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
