The Directorist WordPress plugin, versions 8.5 through 8.9.2, fails to sanitize a user‑supplied image reference before using it as the source of a file move operation. This flaw allows a subscriber‑level user to move any file that the web server can read into a publicly accessible directory, effectively exposing internal files to the web and giving the user the ability to delete the originals. The vulnerability is a classic example of improper input validation and filesystem manipulation. As a result, confidentiality of internal assets is compromised and users can cause unintended data exposure but no direct code execution or privilege escalation is granted by the flaw alone.

WordPress sites that have installed the Directorist plugin (AI‑Powered Business Directory, Listings & Classified Ads) in any version from 8.5 up to but not including 8.9.3. The issue affects all users who possess subscriber or higher‑level accounts and can submit listings via the REST v2 API.

The vulnerability is exploitable through the plugin’s REST v2 listing submission endpoint. An attacker requires only subscriber+ access, which is relatively common on public directory sites. No exploit code is required beyond authenticating and submitting a crafted image reference. The CVSS score is 5.4 and the EPSS score is <1%, indicating a moderate severity and a very low but non‑zero exploitation probability. Despite this, the ability to move arbitrary internal files into a publicly accessible directory poses a significant confidentiality risk. The vulnerability is not listed in the CISA KEV catalog.