Information Exposure in Directorist: AI-Powered WordPress Business Directory Plugin
CVE-2024-12041
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 1 February 2025
What is CVE-2024-12041?
The Directorist: AI-Powered WordPress Business Directory Plugin is susceptible to information exposure due to inadequate access controls in the /wp-json/directorist/v1/users/ endpoint. This vulnerability allows unauthenticated attackers to exploit the API, gaining unauthorised access to sensitive user data, which may include usernames, email addresses, and personal details. Affected installations are urged to update to the latest version to mitigate this significant security risk.
Affected Version(s)
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings * <= 8.0.12