Directorist < 7.0.6.2 - Cross-Site Request Forgery to Arbitrary File Upload

The Directorist plugin for WordPress before 7.0.6.2 does not verify a CSRF nonce on its front-end listing submission handler the addlistingaction AJAX action, registered for unauthenticated users via wpajaxnopriv. An attacker can forge a listing submission - including file uploads - on behalf of ...