Directorist Business Directory Plugin Missing Authorization Vulnerability for Data Export and Slug Modification

A vulnerability exists in the Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings for WordPress, in all versions through 8.5.2. The issue arises from a lack of proper capability checks on the 'directorist_prepare_listings_export_file' and 'directorist_type_slug_change' AJAX actions. This flaw allows authenticated attackers with Subscriber-level access and above to export listing details and modify the Directorist slug.

Impact

Exploitation of this vulnerability could lead to unauthorized data export and unauthorized changes to directory slugs, potentially disrupting the organization and management of listings.

Remediation

Users are advised to update the Directorist plugin to version 8.5.3 or a newer patched version.