CVE-2025-10488

HIGH

The Directorist: AI-Powered Business Directory Plugin with Classifi...

Title source: llm
STIX 2.1

Description

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficient file path validation in the add_listing_action AJAX action in all versions up to, and including, 8.4.8. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).

References (3)

Core 3

Scores

CVSS v3 8.1
EPSS 0.0076
EPSS Percentile 50.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
wpwax/Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings < 8.4.8
wpwax/Directorist: AI-Powered Business Directory, Listings & Classified Ads < 8.4.8
Published Oct 25, 2025
Tracked Since Feb 18, 2026