The vulnerability is a missing authorization check that lets an attacker bypass protected areas of the DesignThemes Directory Addon plugin. By exploiting this flaw, a malicious actor could access, modify, or delete directory listings or configuration settings that should be restricted to authorized users. The flaw originates from incorrectly configured access control security levels and can be leveraged to gain unauthorized control over the plugin’s data and potentially the underlying WordPress site.

WordPress sites running the DesignThemes Directory Addon plugin version 1.8 or earlier are affected. The plugin is available as a WordPress extension under the vendor DesignThemes.

The flaw scores a CVSS base of 7.5, classifying it as high severity, yet its EPSS is less than 1%, indicating a low probability of current exploitation in the wild. It is not listed in the CISA KEV catalog. The likely attack vector is remote access through the WordPress administrative interface; any authenticated user lacking proper privileges could use the plugin’s back‑end pages to perform unauthorized actions.