CVE-2025-1570: Wpwax Directorist Privilege Escalation Flaw

CVE-2025-1570 Overview

CVE-2025-1570 is a critical privilege escalation vulnerability in the Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings for WordPress. The flaw affects all versions up to and including 8.1. Unauthenticated attackers can brute force the one-time password (OTP) used in the password reset workflow to take over any account, including administrator accounts. The vulnerability stems from missing rate limiting and missing authorization checks in the directorist_generate_password_reset_pin_code() and reset_user_password() functions. Because the plugin powers public-facing directory and classified ad sites, the attack surface is reachable from the internet without authentication.

Critical Impact
Unauthenticated attackers can reset any WordPress user's password, including administrators, leading to full site takeover.

Affected Products

wpwax Directorist plugin for WordPress, all versions through 8.1
WordPress sites running Directorist with public registration enabled
Any deployment exposing the plugin's password reset endpoints

Discovery Timeline

2025-02-28 - CVE-2025-1570 published to the National Vulnerability Database
2025-03-06 - Last updated in NVD database

Technical Details for CVE-2025-1570

Vulnerability Analysis

The vulnerability is classified as a weak password recovery mechanism for forgotten passwords [CWE-640]. Directorist implements an OTP-based password reset feature that generates a PIN code, emails it to the account owner, and accepts it through a public endpoint to set a new password. The implementation lacks two essential controls: rate limiting on PIN submission attempts and binding the reset request to the authenticated session that requested it. Attackers exploit this gap by repeatedly submitting candidate PIN values until one matches.

Once a valid PIN is found, the reset_user_password() function accepts the new password and updates the target account. The attacker can target any username or email registered on the site, including the primary administrator account. Successful exploitation yields full WordPress administrator access, enabling plugin uploads, arbitrary code execution through PHP file upload, and persistence.

Root Cause

The root cause is the absence of throttling, lockout, and request-origin validation in the OTP verification path. The directorist_generate_password_reset_pin_code() function produces a PIN with a search space small enough to be exhausted within practical time, and reset_user_password() does not verify that the caller initiated the reset. There is no per-account attempt counter, no IP-based throttle, and no cryptographic binding between the reset token and the requesting client.

Attack Vector

The attack is fully remote, network-based, and unauthenticated. An attacker enumerates a target username such as admin, triggers a password reset to generate an OTP, then submits automated PIN guesses against the public reset endpoint until the correct value is accepted. After the reset succeeds, the attacker logs in with the new password and operates with the victim's privileges. No user interaction from the victim is required beyond the initial reset request initiated by the attacker.

Readers seeking the code-level fix can review the WordPress Change Log Entry and the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-1570

Indicators of Compromise

High volume of POST requests to Directorist password reset endpoints from a single IP or distributed set of IPs within a short window.
Successful password reset events for administrator accounts without a corresponding legitimate user request in support or helpdesk logs.
New administrator logins from unfamiliar IP addresses or geolocations shortly after password reset activity.
Unexpected plugin or theme uploads, new admin user creation, or modifications to wp-config.php following a reset event.

Detection Strategies

Monitor web server access logs for repeated requests carrying OTP or PIN parameters to Directorist AJAX or REST endpoints.
Alert on more than a small threshold of password reset PIN submission attempts per account or per source IP within a minute.
Correlate WordPress password_reset hooks and user_login events to identify resets that immediately precede privileged logins.

Monitoring Recommendations

Forward WordPress audit logs and web access logs to a central SIEM for retention and correlation.
Track changes to the wp_users table, particularly user_pass updates for accounts with the administrator role.
Baseline normal password reset frequency for the site and alert on statistically significant spikes.

How to Mitigate CVE-2025-1570

Immediate Actions Required

Update the Directorist plugin to a version later than 8.1 that contains the fix referenced in changeset 3246340.
Force a password reset for all administrator and editor accounts after patching.
Audit the WordPress user table for unauthorized accounts and recently changed administrator passwords.
Review installed plugins, themes, and uploaded files for unauthorized additions made during the exposure window.

Patch Information

The vendor addressed the vulnerability in the Directorist plugin via WordPress Plugin Changeset 3246340. Site administrators should upgrade to the patched release available through the WordPress plugin repository. After patching, verify the installed version exceeds 8.1 from the WordPress admin Plugins screen.

Workarounds

If immediate patching is not possible, deactivate the Directorist plugin until the update can be applied.
Restrict access to the password reset endpoints with a Web Application Firewall rule that rate-limits requests per IP and per account.
Enforce two-factor authentication for all administrator accounts so a stolen password alone cannot grant access.
Place the WordPress admin area behind an IP allowlist or VPN where operationally feasible.

bash

# Example WP-CLI commands to verify version and rotate admin credentials
wp plugin get directorist --field=version
wp plugin update directorist
wp user list --role=administrator --field=user_login | \
  xargs -I {} wp user reset-password {}