Directorist WordPress plugin vulnerabilities

The Directorist WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites. This allows any authenticated user with subscriber-level access to view and alter another user's favorites.

The Directorist WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it. This allows authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users. This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.

The Directorist WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side. This allows users with the subscriber role and above to make the server issue requests to internal addresses.

The Directorist plugin for WordPress (versions up to and including 8.5.2) lacks capability checks on the 'directorist_prepare_listings_export_file' and 'directorist_type_slug_change' AJAX actions. An authenticated attacker with Subscriber-level access or above can export listing details and change the directorist slug.