The Directorist plugin for WordPress is vulnerable to an arbitrary file move due to insufficient file path validation in the add_listing_action AJAX request. An attacker can instruct the server to move any file on the hosting file system, which can lead to remote code execution if a critical file such as "wp-config.php" is moved into a web‑accessible location. The weakness matches CWE-22 because the plugin allows path traversal.

WordPress sites that have the Directorist AI‑Powered Business Directory plugin from wpwax, any release version up to and including 8.4.8 are affected. The vulnerability is present in all documented versions of the plugin up to that point.

This flaw carries a CVSS score of 8.1 and an EPSS score of less than 1 %. It is not currently listed in the CISA KEV catalog. The description indicates that unauthenticated users can exploit the flaw, whereas the CVE title suggests subscriber‑level authentication may be required; the precise required privileges remain unclear. If an attacker succeeds, they can move arbitrary files on the server, enabling remote code execution by displacing a malicious script into a web‑reachable directory or by altering configuration files.