CVE-2025-12174

Name of the Vulnerable Software and Affected Versions Directorist versions up to and including 8.5.2

Description The Directorist plugin for WordPress is susceptible to unauthorized access. A missing capability check on the directorist prepare listings export file and directorist type slug change AJAX actions allows authenticated attackers with Subscriber-level access or higher to export listing details and modify the directory slug. The affected AJAX actions are: directorist prepare listings export file and directorist type slug change.

Recommendations Update Directorist to a version later than 8.5.2.