Directorist Business Directory Plugin Arbitrary File Move Vulnerability

A vulnerability allowing arbitrary file movement has been identified in the Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings for WordPress, affecting all versions through 8.4.8. The issue arises from inadequate file path validation in the add_listing_action AJAX handler, which could enable unauthenticated attackers to relocate files on the server. This vulnerability could easily be exploited to achieve remote code execution by moving certain files, such as wp-config.php, to a location where they can be executed.

Impact

Exploitation of this vulnerability could lead to remote code execution on the affected server.

Remediation

Users are advised to update the Directorist plugin to version 8.4.9 or later.