The vulnerability exists in the Directorist WordPress plugin version prior to 8.9 where the system does not verify ownership of a post before writing uploaded file references to its metadata. A user with the subscriber role or higher can therefore overwrite image metadata on posts belonging to other users, enabling unauthorized modification of content data. This represents an authorization bypass that allows altered or deleted media associations, potentially disrupting listings or compromising the integrity of posted information.

The affected system is the Directorist WordPress plugin, labeled as Directorist: AI‑Powered Business Directory, Listings & Classified Ads, specifically any installations running a version earlier than 8.9.

The vulnerability permits an authenticated user of the subscriber tier or above to modify other users’ post metadata, a high‑impact data integrity issue. Based on the EPSS score of < 1% and KEV not listed, it is inferred that there are no publicly known exploits at this time. Based on the description, it is inferred that the exploit requires only legitimate authentication and access to the upload function that is exposed to subscribers and higher roles. Because the plugin grants upload capabilities without post‑ownership checks, it is inferred that an attacker can trivially perform the attack if the site allows unauthenticated subscribers to access the upload endpoint. The CVSS score is 3.1, indicating a low overall severity, but the potential impact on data integrity warrants attention.