The vulnerability exists in the Directorist plugin for WordPress, where a missing capability check on the parse_query function allows any user, even unauthenticated, to change a post's status to publish. This flaw permits attackers to publish arbitrary content, potentially leading to defacement, phishing, or spam posts. The weakness corresponds to missing elevation of privilege, CWE‑862.

Affected products are wpwax Directorist: AI‑Powered Business Directory Plugin, Listings & Classified Ads for WordPress versions up to and including 8.2. All earlier versions carry the same issue as the capability check is absent for all of them; any Post type served by this plugin can be altered by an attacker.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% points to low likelihood of current exploitation. However, because the flaw does not require authentication and affects content integrity, attackers can abuse it to post unwanted material. The vulnerability is not listed in CISA KEV, but its potential impact warrants immediate remediation.