Information Exposure in Directorist: AI-Powered WordPress Business Directory Plugin
CVE-2024-12041

5.3MEDIUM

Key Information:

Vendor
WordPress
Status
Directorist: Ai-powered Business Directory Plugin With Classified Ads Listings
Vendor
CVE Published:
1 February 2025

Summary

The Directorist: AI-Powered WordPress Business Directory Plugin is susceptible to information exposure due to inadequate access controls in the /wp-json/directorist/v1/users/ endpoint. This vulnerability allows unauthenticated attackers to exploit the API, gaining unauthorised access to sensitive user data, which may include usernames, email addresses, and personal details. Affected installations are urged to update to the latest version to mitigate this significant security risk.

Affected Version(s)

Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings * <= 8.0.12

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3208874/dire...
https://plugins.trac.wordpress.org/changeset/3231156/dire...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khayal Farzaliyev
.