CVE-2024-13541

Description

The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the adqs_delete_listing() function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected products

aDirectory / aDirectory – WP Business Directory Plugin and Classified Ads Listings Directory0 – 2.3

References

MISChttps://www.wordfence.com/threat-intel/vulnerabilities/id/c99b8a94-c35b-43a1-bb14-2ca97be421cc?source=cve
MISChttps://plugins.trac.wordpress.org/browser/adirectory/tags/1.3.4/inc/Frontend/Ajax.php#L115
MISChttps://plugins.trac.wordpress.org/browser/adirectory/tags/1.9.5/inc/Frontend/Ajax.php#L115
MISChttps://plugins.trac.wordpress.org/browser/adirectory/tags/2.1/inc/Frontend/Ajax.php#L113
MISChttps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3235167%40adirectory&new=3235167%40adirectory&sfp_email=&sfph_mail=