CVE-2024-13887: Business Directory Plugin Auth Bypass

CVE-2024-13887 Overview

CVE-2024-13887 affects the Business Directory Plugin – Easy Listing Directories for WordPress. The plugin contains an Insecure Direct Object Reference (IDOR) flaw [CWE-639] in the ajax_listing_submit_image_upload function. Missing validation on a user-controlled key allows unauthenticated attackers to attach arbitrary images to any listing in the directory. The issue affects all versions up to and including 6.4.14. Attackers can exploit the vulnerability remotely over the network without authentication or user interaction.

Critical Impact
Unauthenticated attackers can add arbitrary images to any business listing, enabling content tampering, brand impersonation, and potential distribution of malicious or offensive imagery through legitimate directory entries.

Affected Products

Business Directory Plugin – Easy Listing Directories for WordPress
All versions up to and including 6.4.14
WordPress sites using the vulnerable plugin

Discovery Timeline

2025-03-13 - CVE-2024-13887 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13887

Vulnerability Analysis

The vulnerability resides in the ajax_listing_submit_image_upload AJAX handler within the Business Directory Plugin. The endpoint accepts a user-supplied identifier that references a target listing but does not verify whether the requester owns or is authorized to modify that listing. This design flaw is the defining characteristic of an Insecure Direct Object Reference [CWE-639].

Because the endpoint is reachable without authentication, any remote user can invoke it. The handler then associates the uploaded image with the listing identified by the attacker-controlled key. The result is unauthorized image insertion across arbitrary listings owned by other users.

The impact is limited to integrity of listing content. Confidentiality and availability are not directly affected, but attackers can leverage this behavior for spam distribution, defacement, phishing lures embedded in imagery, or abuse of storage resources.

Root Cause

The root cause is missing authorization on the object reference passed to ajax_listing_submit_image_upload. The plugin trusts the client-supplied listing key without confirming that the current session or nonce is authorized to modify that listing. Neither a capability check nor an ownership check is enforced before the image is written and linked to the target record.

Attack Vector

An unauthenticated attacker sends a crafted HTTP POST request to the WordPress admin-ajax.php endpoint invoking the vulnerable action. The request includes an image payload and a listing identifier chosen by the attacker. The plugin processes the upload and associates the image with the referenced listing. No credentials, tokens, or user interaction are required. Exploitation succeeds against any site running an affected plugin version with the AJAX endpoint reachable.

No public proof-of-concept code has been verified. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for technical details on the fix.

Detection Methods for CVE-2024-13887

Indicators of Compromise

Unexpected images appearing on business directory listings without corresponding owner activity in the WordPress audit log.
POST requests to /wp-admin/admin-ajax.php invoking the ajax_listing_submit_image_upload action from unauthenticated sessions.
Spikes in image uploads to the plugin's media storage directory that do not correlate to legitimate listing edits.

Detection Strategies

Inspect web server logs for repeated POST requests to admin-ajax.php referencing the vulnerable action with varying listing identifiers.
Correlate image upload events with authenticated user sessions; flag uploads that lack a matching authenticated request.
Compare listing image inventories against historical baselines to identify unauthorized additions.

Monitoring Recommendations

Enable WordPress activity logging with plugin-level granularity to record image attachment events.
Forward web server and WordPress audit logs to a centralized SIEM for correlation and alerting.
Alert on requests to the vulnerable AJAX action originating from IPs without prior authenticated sessions.

How to Mitigate CVE-2024-13887

Immediate Actions Required

Update the Business Directory Plugin to a version later than 6.4.14 that includes the fix from changeset 3249927.
Audit all listings for unauthorized image additions since the plugin was installed.
Restrict access to admin-ajax.php from untrusted networks where feasible using a web application firewall rule.

Patch Information

The vendor addressed the issue in the plugin trunk via changeset 3249927. The patch adds validation on the user-controlled key so that only authorized users can attach images to a listing. Site administrators should install the corresponding released plugin version through the WordPress plugin repository.

Workarounds

Deploy a web application firewall rule that blocks unauthenticated requests to admin-ajax.php invoking the ajax_listing_submit_image_upload action.
Temporarily disable the Business Directory Plugin if patching cannot be completed immediately and the directory feature is not business-critical.
Restrict image upload directories to require authentication at the web server level as a defense-in-depth measure.

bash

# Example nginx rule to block the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "ajax_listing_submit_image_upload") {
        return 403;
    }
}