CVE-2025-2224mediumCWE-862

CVE-2025-2224: fallo de gravedad media en wpwax Directorist: AI-Powered Business…

Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Directorist: AI-Powered Business Directory, Listings & Classified Ads

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.4%
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'parse_query' function in all versions up to, and including, 8.2. This makes it possible for unauthenticated attackers to update the post_status of any post to 'publish'.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
wpwax · Directorist: AI-Powered Business Directory, Listings & Classified Ads
CVEs relacionadas — wpwax Directorist: AI-Powered Business…

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-1888HIGHDirectorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege EscalationEPSS 1.0%CVE-2025-10488HIGHDirectorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File MoveEPSS 0.9%CVE-2023-1889MEDIUMDirectorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_taskEPSS 0.6%CVE-2026-17092HIGHDirectorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' ParameterEPSS 0.5%CVE-2024-1322MEDIUMDirectorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings ChangeEPSS 0.5%CVE-2025-1570HIGHDirectorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTPEPSS 0.4%