The vulnerability stems from the Directorist plugin failing to verify that a user is authorized before performing a deletion. Authenticated users with subscriber-level access and higher can craft requests to the AJAX handler endpoint and supply a listing_id to delete any directory record. The plugin exposes its nonces to all logged-in users, so the missing authorization barrier allows arbitrary deletions of listings in any status, including drafts, published, and private. This results in loss of legitimate business directory data and can damage a site’s reputation or compliance posture.

WordPress sites running the Directorist plugin version 8.10.2.1 or earlier are affected. The vendor is wpwax, and the product is Directorist: AI-Powered Business Directory, Listings & Classified Ads. Any installation of the plugin below the 8.10.2.2 release lacks the authorization check that has been added in later versions.

The CVSS score of 8.1 indicates high severity due to the impact on data integrity and the user scope of the vulnerability. The EPSS score of less than 1% suggests that exploitation is currently rare, possibly because the attacker must first authenticate, and attackers may not yet have discovered the flaw. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by simply authenticating with a valid subscriber or manager level account and sending a crafted AJAX request to delete a chosen listing. Because the endpoint lacks proper permission checks, no additional privileges are required beyond the base subscription role.