CVE-2023-1889: Directorist <= 7.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion in listing_task
The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4. This is due to improper validation and authorization checks within the listingtask function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1889?
The severity of CVE-2023-1889 is medium with a severity value of 6.5.
What is the vulnerability in the Directorist plugin for WordPress?
The vulnerability in the Directorist plugin for WordPress is an Insecure Direct Object Reference.
Which versions of the Directorist plugin for WordPress are affected?
Versions up to and including 7.5.4 of the Directorist plugin for WordPress are affected.
What can an authenticated attacker do with this vulnerability?
An authenticated attacker, with subscriber-level privileges, can exploit this vulnerability.
How can I fix the vulnerability in the Directorist plugin for WordPress?
The vulnerability can be fixed by updating the Directorist plugin for WordPress to a version beyond 7.5.4.