The Directorist plugin’s password reset logic lacks controls against OTP brute force. The generate_password_reset_pin_code() function fails to limit OTP issuance and the reset_user_password() function does not validate that a request originates from an authorized user. Unauthenticated attackers can generate a reset token, brute‑force the one‑time password, and change any user’s password, including administrator accounts. This leads to complete compromise of the WordPress installation’s administrative access and control.

All installations of the wpwax Directorist plugin up to and including version 8.1 are affected. The vulnerability exists in the core password reset functionality used by the plugin’s business listing and classified ads features.

The CVSS score of 8.1 marks this issue as high severity. The EPSS of less than 1% indicates low current exploitation probability, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers would exploit the flaw by sending unauthenticated requests to the plugin’s OTP generation and reset endpoints, brute‑forcing the code, and resetting any user’s password. While the vulnerability requires no prior credential, successful mitigation depends on blocking or hardening the exposed reset interfaces.