CVE-2024-1322 Overview
The Directorist – WordPress Business Directory Plugin with Classified Ads Listings contains a missing authorization vulnerability in its setup_wizard function. All versions up to and including 7.8.4 are affected. Unauthenticated attackers can invoke setup wizard actions to recreate default pages, toggle monetization settings, and change the configured map provider. The flaw is tracked under CWE-862: Missing Authorization and was resolved in version 7.8.5. WordPress sites running Directorist as a public directory or classifieds platform are exposed to unauthenticated configuration tampering over the network.
Critical Impact
Unauthenticated attackers can modify plugin configuration, recreate default pages, and toggle monetization on affected WordPress sites without any user interaction.
Affected Products
- wpwax Directorist plugin for WordPress, all versions through 7.8.4
- WordPress sites using Directorist as a business directory or classified ads platform
- Sites that have not upgraded to Directorist 7.8.5 or later
Discovery Timeline
- 2024-02-29 - CVE-2024-1322 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1322
Vulnerability Analysis
The vulnerability is a broken access control issue in the Directorist plugin's setup wizard component. The setup_wizard function in class-setup-wizard.php exposes administrative configuration actions without validating the caller's WordPress capability or role. Because the handler is registered to standard request hooks, unauthenticated visitors can reach it directly over HTTP.
Attackers can trigger three distinct outcomes: recreation of the plugin's default pages, enabling or disabling monetization features, and changing the configured map provider. Recreated pages can overwrite site content and disrupt directory workflows. Toggling monetization can disable paid-listing controls and break the revenue model of directory sites. Changing the map provider can redirect users to an attacker-preferred integration or degrade service availability. Impact is limited to integrity of plugin configuration; the flaw does not directly leak data or grant code execution.
Root Cause
The root cause is a missing capability check in the setup wizard handler. WordPress plugins are expected to call current_user_can() or verify an administrative nonce before executing privileged actions. The vulnerable handler performs neither check consistently, so any request reaching the endpoint is treated as authorized.
Attack Vector
Exploitation requires only network access to the target WordPress site. An attacker sends crafted HTTP requests to the endpoint that invokes the setup wizard action, supplying parameters that select which configuration change to perform. No authentication, no user interaction, and no elevated privileges are required. See the WordPress Class Setup Wizard source and the Wordfence vulnerability report for handler-level technical details.
No public proof-of-concept exploit code is documented in the enriched CVE data, and this entry is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-1322
Indicators of Compromise
- Unexpected recreation of Directorist default pages such as directory listing, dashboard, or checkout pages
- Unexplained toggling of the plugin's monetization setting in wp_options or the Directorist settings table
- Changes to the configured map provider (Google Maps, OpenStreetMap) without a corresponding administrator action in the audit log
- HTTP requests from unauthenticated sessions targeting Directorist setup wizard endpoints
Detection Strategies
- Monitor web server access logs for POST or GET requests referencing Directorist setup wizard actions from sessions without a valid wordpress_logged_in_ cookie
- Alert on modifications to Directorist configuration options when no administrator session is active
- Compare current plugin settings against a known-good baseline on a scheduled basis
Monitoring Recommendations
- Enable WordPress audit logging to capture option changes, page creation events, and plugin setting updates
- Forward WordPress and web server logs to a centralized analytics platform for correlation across sites
- Track the installed Directorist version across the estate and flag any host still running 7.8.4 or earlier
How to Mitigate CVE-2024-1322
Immediate Actions Required
- Upgrade the Directorist plugin to version 7.8.5 or later on every affected WordPress site
- Review Directorist configuration for unauthorized changes to pages, monetization settings, and map provider
- Restore any recreated or overwritten pages from a clean backup if tampering is detected
- Rotate administrator credentials if configuration tampering is confirmed and further compromise is suspected
Patch Information
The vendor released Directorist 7.8.5 with a capability check added to the setup wizard handler. Details of the code change are available in the WordPress plugin changeset from 7.8.4 to 7.8.5. Site administrators should apply the update through the WordPress plugin management interface or by using WP-CLI.
Workarounds
- If patching is delayed, restrict access to wp-admin and admin-ajax.php at the web application firewall or reverse proxy layer
- Block unauthenticated HTTP requests carrying Directorist setup wizard action parameters using WAF rules
- Temporarily deactivate the Directorist plugin on sites where the setup wizard is not required
# Configuration example: upgrade Directorist using WP-CLI
wp plugin update directorist --version=7.8.5
wp plugin list --name=directorist --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
