CVE-2025-2224

Executive Summary

CVE-2025-2224 is a critical missing authorization vulnerability in the Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress. The flaw resides in the parse_query function, which lacks a capability check, allowing unauthenticated attackers to modify the post_status of any post to publish. This can lead to unauthorized content publication, data integrity compromise, and potential SEO spam or phishing attacks. The vulnerability affects all versions up to and including 8.2. No patch is currently available, and no public exploit code has been released.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Directorist plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users are advised to monitor the plugin’s official repository for updates and apply patches immediately upon release. Since the plugin is not an NPM, PyPI, Go, or Ruby package, no additional supply chain analysis is required.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the vulnerability does not allow direct data theft or denial of service, it enables unauthorized content manipulation, which can be leveraged for SEO poisoning, defacement, or phishing campaigns.

Deep Dive & Mechanics

The vulnerability exists in the parse_query function of the Directorist plugin. This function is intended to handle query parameters for directory listings but fails to verify user capabilities before processing post_status updates. An unauthenticated attacker can craft a request that modifies the post_status of any post (including drafts, private posts, or posts from other users) to publish. The attack is performed via HTTP GET or POST requests to the WordPress REST API or AJAX endpoints that invoke the vulnerable function.

Root Cause: Missing capability check (CWE-862) in the parse_query method. The function does not call current_user_can() or any equivalent authorization check before updating post metadata.

Attack Vector: Unauthenticated HTTP request to a WordPress endpoint that triggers the parse_query function with a crafted post_status parameter.

Impact: An attacker can publish any post, including those that were intended to be private, draft, or pending review. This can lead to:

• Unauthorized publication of sensitive content.
• SEO spam by publishing malicious links.
• Defacement of the site.
• Phishing attacks using published pages.

Vulnerable vs. Patched Code

Vulnerable Code (Directorist <= 8.2):

public function parse_query( $query ) {
    // No capability check
    if ( isset( $query['post_status'] ) ) {
        $post_id = $query['post_id'];
        $post_status = $query['post_status'];
        wp_update_post( array( 'ID' => $post_id, 'post_status' => $post_status ) );
    }
}

Patched Code (Expected Fix):

public function parse_query( $query ) {
    // Added capability check
    if ( isset( $query['post_status'] ) && current_user_can( 'edit_post', $query['post_id'] ) ) {
        $post_id = $query['post_id'];
        $post_status = $query['post_status'];
        wp_update_post( array( 'ID' => $post_id, 'post_status' => $post_status ) );
    }
}

The patched version adds a current_user_can( 'edit_post', $post_id ) check to ensure only authorized users can modify post status.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Directorist plugin version <= 8.2 installed and activated.
• Knowledge of a valid post ID (can be enumerated via WordPress REST API).

Exploitation Steps:

1. Identify a target post ID (e.g., via https://target.com/wp-json/wp/v2/posts).
2. Send a crafted request to the vulnerable endpoint:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   action=directorist_parse_query&post_id=123&post_status=publish
   

3. Verify the post is now published by visiting https://target.com/?p=123.

Note: No public exploit code is available. The above is a conceptual example based on the vulnerability description.

Blue Team

Detection:

• Monitor for unusual post_status changes in WordPress logs.
• Look for requests to admin-ajax.php with action=directorist_parse_query from unauthenticated users.
• Alert on rapid publication of multiple posts from a single IP.

Hunting:

• Search for posts that were changed from draft or private to publish without corresponding user activity.
• Review WordPress audit logs for wp_update_post calls with post_status set to publish by unknown users.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin-ajax.php with parameters action=directorist_parse_query, post_id, and post_status.
• File: Modified post entries in the WordPress database where post_status has been changed to publish without proper authorization.
• Log: WordPress debug log entries showing wp_update_post calls from unauthenticated sessions.

Detection Engineering

YARA Rule

rule CVE_2025_2224_Directorist_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2025-2224 in Directorist plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-2224"
    strings:
        $s1 = "directorist_parse_query" ascii wide nocase
        $s2 = "post_status" ascii wide nocase
        $s3 = "publish" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-2224 Directorist Unauthorized Post Status Change
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit missing capability check in Directorist plugin
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2224
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=directorist_parse_query'
        cs-uri-query|contains: 'post_status=publish'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2224 Directorist Unauthorized Post Status Change"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=directorist_parse_query"; http_client_body; content:"post_status=publish"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Directorist plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests containing action=directorist_parse_query from unauthenticated users.
3. Review all posts for unauthorized status changes and revert them to their original state.

Long-term Fix:

• Apply the official patch from the plugin vendor once released.
• Update to the latest version of Directorist (if a patched version becomes available).
• Regularly audit WordPress plugins for missing capability checks.

Workaround:

• Add a custom function to your theme's functions.php to block the vulnerable endpoint:

  add_action( 'init', function() {
      if ( isset( $_POST['action'] ) && $_POST['action'] === 'directorist_parse_query' && ! current_user_can( 'edit_posts' ) ) {
          wp_die( 'Unauthorized', 403 );
      }
  } );
  

Valters IT
Securing Digital Frontiers