CVE-2024-1322

The CVE affects the Directorist – WordPress Business Directory Plugin with Classified Ads Listings up to version 7.8.4. The root cause is a missing capability check in the setup_wizard, enabling unauthenticated attackers to modify data, recreate default pages, and enable/disable monetization or c...

CVE-2024-1322 Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change

The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setupwizard' function in all versions up to, and including, 7.8.4. This makes it possible for...

WordPress Directorist Plugin <= 7.8.4 is vulnerable to Broken Access Control

Software Directorist Type Plugin Vulnerable versions = 7.8.4 Fixed in 7.8.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1322 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID dd1efe90eebb Credits Lucio Sá Required privilege...