Arbitrary File Move Vulnerability in Directorist: AI-Powered Business Directory Plugin for WordPress
CVE-2025-10488
8.1HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 October 2025
What is CVE-2025-10488?
The Directorist: AI-Powered Business Directory Plugin for WordPress is exposed to a vulnerability that allows unauthenticated attackers to exploit insufficient file path validation in the add_listing_action AJAX action. This loophole is present in all versions up to and including 8.4.8. As a result, attackers can relocate arbitrary files within the server, potentially leading to severe consequences such as remote code execution if sensitive files like wp-config.php are manipulated.
Affected Version(s)
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings * <= 8.4.8