The vulnerability exists because the Directorist plugin does not verify that an authenticated requester owns the referenced listing before returning its metadata via an AJAX action, allowing a subscriber or higher privileged user to read another user's private and unpublished draft listing details, including contact information. This exposure can facilitate phishing or other social engineering attacks against the victim.

All WordPress sites that use the Directorist: AI‑Powered Business Directory, Listings & Classified Ads plugin with a version earlier than 8.11 are impacted. Installations that have upgraded to version 8.11 or newer are no longer susceptible.

The attacker must be authenticated, which is a moderate barrier but common for many users with subscriber access. The exploit path is a straightforward IDOR via the plugin’s AJAX endpoint, reachable over standard HTTPS. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Although no CVSS score is provided, the consequence of leaking private contact details indicates a high severity for affected sites.