CVE-2025-2224: Directorist Plugin Auth Bypass Vulnerability

CVE-2025-2224 Overview

CVE-2025-2224 is a Missing Authorization vulnerability (CWE-862) affecting the Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress. The vulnerability exists due to a missing capability check on the parse_query function in all versions up to and including 8.2. This security flaw enables unauthenticated attackers to modify data without proper authorization, specifically allowing them to update the post_status of any post to 'publish'.

Critical Impact

Unauthenticated attackers can bypass authorization controls and publish arbitrary posts, potentially exposing draft content, private information, or enabling the publication of malicious content on affected WordPress sites.

Affected Products

• Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings for WordPress versions up to and including 8.2

Discovery Timeline

• 2025-03-25 - CVE-2025-2224 published to NVD
• 2025-03-27 - Last updated in NVD database

Technical Details for CVE-2025-2224

Vulnerability Analysis

This vulnerability is classified as Missing Authorization (CWE-862), which occurs when the software does not perform an authorization check when an actor attempts to access a resource or perform an action. In this case, the parse_query function in the Directorist plugin lacks proper capability checks, allowing any user—including unauthenticated visitors—to manipulate post statuses.

The vulnerable code resides in the class-add-listing.php file within the plugin's includes/classes directory. When the parse_query function is invoked, it fails to verify whether the requesting user has the necessary permissions to modify post data. This architectural oversight allows attackers to change the post_status attribute of any post to 'publish', effectively bypassing WordPress's built-in content moderation workflow.

Root Cause

The root cause of this vulnerability is the absence of proper authorization checks in the parse_query function. WordPress plugins should implement capability checks using functions like current_user_can() before allowing users to perform sensitive operations such as modifying post statuses. The Directorist plugin failed to implement these security controls, creating an authorization bypass that can be exploited without authentication.

Attack Vector

The attack can be performed remotely over the network without requiring any authentication or user interaction. An attacker can craft malicious requests targeting the vulnerable parse_query function to change the publication status of posts. This could be used to:

• Publish draft posts containing sensitive or incomplete information
• Expose private posts to public viewing
• Disrupt content management workflows
• Potentially publish spam or malicious content if attackers can create draft posts through other means

The vulnerability is detailed in the Wordfence Vulnerability Report. Technical details of the vulnerable code can be reviewed in the WordPress Plugin Trac repository.

Detection Methods for CVE-2025-2224

Indicators of Compromise

• Unexpected publication of draft or private posts without administrator action
• Unusual HTTP requests targeting the Directorist plugin's add-listing functionality
• Posts with post_status changes in WordPress logs without corresponding user activity
• Anomalous activity in WordPress access logs from unauthenticated sources targeting plugin endpoints

Detection Strategies

• Monitor WordPress database logs for unauthorized post_status modifications
• Implement Web Application Firewall (WAF) rules to detect and block suspicious requests to Directorist plugin endpoints
• Review WordPress audit logs for unexpected post publication events
• Deploy file integrity monitoring on plugin directories to detect unauthorized changes

Monitoring Recommendations

• Enable verbose logging for WordPress and the Directorist plugin
• Configure alerts for bulk or rapid post status changes
• Monitor for requests to class-add-listing.php from unauthenticated sessions
• Implement real-time monitoring of WordPress post metadata changes

How to Mitigate CVE-2025-2224

Immediate Actions Required

• Update the Directorist plugin to the latest patched version immediately
• Review all posts for unauthorized status changes, particularly any that were recently published
• Temporarily disable the Directorist plugin if an update is not immediately available
• Implement WAF rules to restrict access to vulnerable plugin endpoints until patching is complete

Patch Information

The vulnerability has been addressed in the WordPress Plugin Changeset 3260639. Site administrators should update to the latest version of the Directorist plugin that includes proper capability checks on the parse_query function. The patch adds authorization verification to ensure only users with appropriate permissions can modify post statuses.

Workarounds

• Disable the Directorist plugin until a patch can be applied
• Implement server-level access controls to restrict requests to the vulnerable endpoint
• Use a WordPress security plugin with virtual patching capabilities to block exploitation attempts
• Configure .htaccess rules to limit access to the class-add-listing.php file to authenticated administrators only

# Example .htaccess workaround to restrict access to the vulnerable file
<Files "class-add-listing.php">
    Order Deny,Allow
    Deny from all
    # Allow only authenticated admin access via your CMS
</Files>