CVE-2026-17092 in Directorist AI-Powered Business Directory, Listings & Classified Ads Plugin
Summary
by MITRE • 10/14/2026
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The Directorist plugin for WordPress represents a significant component of many business directory websites, facilitating the management of listings, classified ads, and local search results. A critical security flaw has been identified in versions up through 8.10.2.1 that undermines the fundamental integrity of user data within these directories. The vulnerability stems from an improper implementation of access control mechanisms, specifically failing to verify whether a requesting user possesses the necessary privileges to execute specific administrative or management actions on directory entries. This flaw allows authenticated attackers who have subscriber-level access and above to bypass intended restrictions and perform unauthorized operations against business listings.
The core technical issue lies in the plugin's reliance on nonces for security validation without implementing proper server-side authorization checks. While WordPress typically uses nonces as a CSRF protection mechanism, they are not designed to enforce role-based access control or object-level permissions. In this specific case, both directorist_nonce and atbdp_nonce_js were exposed to all logged-in users via the wp_localize_script function. This exposure means that any authenticated user can retrieve these tokens from the page source and utilize them in subsequent requests. Consequently, an attacker with minimal privileges can craft malicious requests that appear legitimate due to valid nonces, thereby tricking the application into executing actions such as deleting listings owned by other users or modifying posts regardless of their publication status.
The operational impact of this vulnerability is severe for both website administrators and end-users relying on the directory service. Attackers with subscriber-level access can delete arbitrary business directory listings, leading to data loss and potential disruption of business operations for affected entities. Furthermore, the ability to manipulate posts in publish, draft, or private status indicates a broader compromise of content integrity. This level of control allows attackers to deface websites, remove critical information, or potentially use deleted items as part of larger social engineering campaigns by restoring them with malicious intent if other vulnerabilities exist. The lack of proper authorization checks means that the principle of least privilege is effectively ignored within the plugin's functionality.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-352 Cross-Site Request Forgery (CSRF). Although CSRF protections are present via nonces, they fail to address the underlying authorization flaw where users can perform actions outside their assigned roles. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1078 Valid Accounts, as it leverages legitimate credentials with low-level privileges to escalate impact through improper access control mechanisms rather than traditional privilege escalation exploits. The attack vector is remote and requires authentication, placing it within the context of authenticated API abuse or endpoint manipulation.
Mitigation strategies must focus on immediate remediation and long-term architectural improvements. Administrators should update the Directorist plugin to version 8.10.2.2 or later where this issue has been addressed by implementing proper server-side authorization checks that verify user roles against specific actions before execution. Until an update is applied, administrators can consider restricting access to directory management features through custom code snippets that enforce stricter role-based permissions at the application level rather than relying solely on plugin-provided nonces. Additionally, reviewing and minimizing the exposure of sensitive data via wp_localize_script for endpoints requiring high-privilege actions can reduce the attack surface. Regular security audits focusing on authorization logic in WordPress plugins are essential to prevent similar vulnerabilities where nonce validation is mistaken for comprehensive access control.