Medium severity · published Mar 25, 2025
CVE-2025-2224
Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'parse_query' function in all versions up to, and including, 8.2. This makes it possible for unauthenticated attackers to update the post_status of any post to 'publish'.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
Directorist: AI-Powered Business Directory, Listings & Classified Ads · wpwax
through 8.2 · source: vendor
Affected product
DA
Directorist: AI-Powered Business Directory, Listings & Classified Ads
wpwax
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2224
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2224
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/directorist/trunk/includes/classes/class-add-listing.php#L912
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/directorist/trunk/includes/classes/class-add-listing.php#L942
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/directorist/trunk/includes/classes/class-add-listing.php#L960
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3260639/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/684e6a97-b884-4d25-99f1-81c2a43f1239?source=cve
More from Directorist: AI-Powered Business Directory, Listings & Classified Ads
9.8
CVE-2025-1570
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP
8.1
CVE-2026-17092
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter
8.1
CVE-2025-10488
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move
6.5
CVE-2025-12174
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update
6.4
CVE-2026-100185
Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field