CVE-2025-12174: Directorist Plugin Auth Bypass Flaw

CVE-2025-12174 Overview

CVE-2025-12174 affects the Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress. The plugin fails to enforce capability checks on the directorist_prepare_listings_export_file and directorist_type_slug_change AJAX actions. All versions up to and including 8.5.2 are affected. Authenticated attackers with Subscriber-level access or above can export listing details and modify the directorist slug. The flaw is classified as Missing Authorization [CWE-862]. Version 8.5.3 addresses the issue.

Critical Impact
Low-privileged authenticated users can exfiltrate listing data and tamper with directory type slugs, degrading site integrity and exposing potentially sensitive listing content.

Affected Products

Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings for WordPress
All versions up to and including 8.5.2
WordPress sites exposing Subscriber-level or higher accounts

Discovery Timeline

2025-11-19 - CVE-2025-12174 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12174

Vulnerability Analysis

The Directorist plugin registers two AJAX handlers, directorist_prepare_listings_export_file and directorist_type_slug_change, without verifying the calling user's capabilities. WordPress AJAX endpoints registered under the wp_ajax_* hook are accessible to any authenticated user by default. Without an explicit current_user_can() check or nonce-bound role verification, both endpoints accept requests from Subscriber-level accounts.

The directorist_prepare_listings_export_file action generates an export of listing records. When invoked by an unprivileged user, it returns listing data that should be restricted to administrators or listing owners. The directorist_type_slug_change action modifies the directory type slug, a configuration value that affects URL structure and site behavior.

Exploitation requires only a valid authenticated session. On WordPress sites permitting open registration, an attacker can create a Subscriber account and immediately invoke either endpoint.

Root Cause

The root cause is Missing Authorization [CWE-862] in the AJAX handler class. The handler functions in includes/classes/class-ajax-handler.php did not include role or capability validation before performing privileged operations. The upstream fix in changeset 3394856 for tag 8.5.3 adds the missing checks. See the WordPress Plugin Changeset for the patch diff.

Attack Vector

An attacker authenticates as a Subscriber or higher, then issues a POST request to /wp-admin/admin-ajax.php with the action parameter set to directorist_prepare_listings_export_file or directorist_type_slug_change. The server executes the requested operation because no capability check gates the handler. No user interaction beyond authentication is required, and the attack is executable over the network.

Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-12174

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=directorist_prepare_listings_export_file originating from Subscriber-level user sessions.
POST requests to /wp-admin/admin-ajax.php containing action=directorist_type_slug_change from non-administrator accounts.
Unexpected changes to the Directorist type slug configuration in the WordPress database.
Newly created Subscriber accounts followed by AJAX activity targeting Directorist endpoints.

Detection Strategies

Parse web server access logs for the two AJAX action names and correlate the originating wordpress_logged_in_* cookies to non-privileged user IDs.
Enable WordPress audit logging to record option changes affecting Directorist configuration keys.
Monitor for anomalous export file generation events on the site's uploads directory.

Monitoring Recommendations

Alert on any AJAX call to Directorist actions performed by users lacking the manage_options capability.
Track spikes in registrations followed by immediate admin-ajax.php traffic to Directorist actions.
Review database change logs for modifications to Directorist listing type slug records.

How to Mitigate CVE-2025-12174

Immediate Actions Required

Update the Directorist plugin to version 8.5.3 or later on every WordPress instance.
Audit existing Subscriber and low-privilege accounts for suspicious activity against admin-ajax.php.
Rotate any listing data considered sensitive if unauthorized exports are suspected.
Verify the current Directorist type slug matches the intended configuration.

Patch Information

The vendor released a fix in Directorist version 8.5.3. The patch, tracked in WordPress Plugin Changeset 3394856, adds capability checks to both directorist_prepare_listings_export_file and directorist_type_slug_change AJAX handlers in includes/classes/class-ajax-handler.php.

Workarounds

Disable open user registration on WordPress sites where Subscriber accounts are not required.
Restrict access to /wp-admin/admin-ajax.php at the web application firewall (WAF) layer for the two vulnerable action names until patching is complete.
Temporarily deactivate the Directorist plugin if immediate patching is not feasible.

bash

# WAF rule example blocking the vulnerable AJAX actions pre-patch
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1012174,msg:'Block CVE-2025-12174 Directorist AJAX'"
  SecRule ARGS:action "@rx ^(directorist_prepare_listings_export_file|directorist_type_slug_change)$"