CVE-2025-10488: Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficient file path validation in the addlistingaction AJAX action in all versions up to, and including, 8.4.8. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10488?
CVE-2025-10488 is considered a high severity vulnerability due to its potential for arbitrary file manipulation.
How do I fix CVE-2025-10488?
To fix CVE-2025-10488, update the Directorist AI-Powered Business Directory Plugin to version 8.4.9 or later.
What versions are affected by CVE-2025-10488?
CVE-2025-10488 affects all versions of the Directorist plugin up to and including version 8.4.8.
What type of vulnerability is CVE-2025-10488?
CVE-2025-10488 is an arbitrary file move vulnerability caused by insufficient file path validation.
Is CVE-2025-10488 easy to exploit?
Yes, CVE-2025-10488 can be easily exploited due to the lack of proper validation mechanisms in the add_listing_action AJAX action.