What’s Vulnerable › Vulnerabilities

CVE-2023-1889: Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-09 · updated 2026-06-17
• Weakness: CWE-639

Description

The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4. This is due to improper validation and authorization checks within the listing_task function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts. Please note CVE-2023-35052 appears to be a duplicate of this issue.

Affected products

• wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads: through 7.5.4

References

• https://plugins.trac.wordpress.org/changeset/2920100/directorist
• https://www.wordfence.com/blog/2023/06/critical-security-update-directorist-wordpress-plugin-patches-two-high-risk-vulnerabilities/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b47edd57-cac7-463f-88cc-8922f1b34612?source=cve
• https://plugins.trac.wordpress.org/changeset/2920100/directorist
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b47edd57-cac7-463f-88cc-8922f1b34612?source=cve

Get alerted when CVE-2023-1889 or the next vulnerability affects your stack