CVE-2025-2224: Directorist <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'parsequery' function in all versions up to, and including, 8.2. This makes it possible for unauthenticated attackers to update the poststatus of any post to 'publish'.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: Directorist (AI-Powered Business Directory Plugin with Classified Ads Listings)to a version that resolves this vulnerability.Fixed in 8.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2224?
The severity of CVE-2025-2224 is considered high due to the potential for unauthorized access and data modification.
How do I fix CVE-2025-2224?
To fix CVE-2025-2224, update the Directorist plugin to version 8.3 or later where the vulnerability is addressed.
Who is affected by CVE-2025-2224?
Any users of the Directorist plugin for WordPress running versions up to and including 8.2 are affected by CVE-2025-2224.
What type of vulnerability is CVE-2025-2224?
CVE-2025-2224 is a security vulnerability related to unauthorized access and lack of capability checks in the plugin.
When was CVE-2025-2224 disclosed?
CVE-2025-2224 was disclosed in 2025, bringing attention to the weaknesses in the Directorist plugin.