CVE-2024-1322 in Directorist Plugin
Summary
by MITRE • 02/29/2024
The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 7.8.4. This makes it possible for unauthenticated attackers to recreate default pages and enable or disable monetization and change map provider.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/12/2026
The vulnerability identified as CVE-2024-1322 affects the Directorist WordPress plugin, a popular business directory solution that enables users to create classified ads listings. This plugin serves as a comprehensive directory management system for WordPress websites, facilitating the creation and management of business directories with various monetization options. The specific flaw resides within the setup_wizard function which lacks proper capability verification, creating a critical security gap that undermines the plugin's access controls.
The technical implementation of this vulnerability stems from the absence of capability checks within the setup_wizard function, which operates without requiring authentication or authorization verification. This missing validation allows any unauthenticated user to access and manipulate core plugin configuration parameters. The flaw specifically enables attackers to recreate default pages, modify monetization settings, and change map provider configurations without proper authorization. The vulnerability exists across all plugin versions up to and including 7.8.4, indicating a widespread exposure affecting numerous website installations.
The operational impact of this vulnerability extends beyond simple data modification to encompass significant security implications for affected websites. Unauthenticated attackers can potentially disrupt business operations by altering core directory functionality, modifying revenue streams through monetization changes, or compromising the user experience by changing map providers. This vulnerability essentially grants attackers administrative-like capabilities without proper authentication, potentially leading to complete compromise of the directory functionality and associated business data. The ability to recreate default pages could also be leveraged to inject malicious content or redirect users to harmful locations.
From a cybersecurity perspective, this vulnerability aligns with CWE-284 (Improper Access Control) and represents a critical authorization flaw in the plugin's architecture. The ATT&CK framework categorizes this as a privilege escalation technique where attackers exploit missing access controls to gain elevated capabilities. Organizations using this plugin face heightened risk of data integrity compromise, potential service disruption, and possible financial loss due to unauthorized monetization modifications. The vulnerability's impact is particularly concerning given that it affects a widely-used WordPress plugin, potentially exposing thousands of websites to similar threats.
Mitigation strategies should prioritize immediate plugin updates to versions that address this capability check deficiency. System administrators must ensure all instances of the Directorist plugin are updated to the latest secure version available from the plugin developers. Additionally, implementing network-level restrictions and monitoring for unauthorized access attempts can provide additional defensive layers. Security teams should conduct comprehensive audits of all WordPress installations to identify and remediate similar access control vulnerabilities across other plugins and themes. Regular security assessments and vulnerability scanning should be implemented to maintain ongoing protection against such authorization flaws that could potentially exist in other components of the WordPress ecosystem.