Directorist < 7.5.5 - Subscriber+ Insecure Direct Object Reference to Arbitrary Post Deletion

2023-06-0700:00:00

wpscan.com

plugin validation unauthorized users less-privileged subscribers arbitrary post deletion

0.001 Low

EPSS

Percentile

40.6%

JSON

The plugin does not properly validate that users are authorized to delete a given listing, or that it is a listing at all, making it possible for less-privileged users like subscribers to delete posts.

CPENameOperatorVersion
directoristlt7.5.5

CPE	Name	Operator	Version
	directorist	lt	7.5.5

References

www.wordfence.com/blog/2023/06/critical-security-update-directorist-wordpress-plugin-patches-two-high-risk-vulnerabilities/

0.001 Low

EPSS

Percentile

40.6%

JSON

Related for WPVDB-ID:9E5A95C4-F566-4CF3-85E6-C95A1739A4B5