CVE-2025-10488

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10488", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-15T14:42:08.792Z", "datePublished": "2025-10-25T06:49:21.186Z", "dateUpdated": "2026-04-08T16:41:39.661Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:39.661Z"}, "affected": [{"vendor": "wpwax", "product": "Directorist: AI-Powered Business Directory, Listings & Classified Ads", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "8.4.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficient file path validation in the add_listing_action AJAX action in all versions up to, and including, 8.4.8. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php)."}], "title": "Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2249ef72-9955-4636-b32f-e88720923268?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/directorist/tags/8.4.5/includes/classes/class-add-listing.php#L634"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3377181%40directorist&new=3377181%40directorist&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Arkadiusz Hydzik"}], "timeline": [{"time": "2025-10-10T19:26:15.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-24T17:34:40.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-27T15:54:03.652256Z", "id": "CVE-2025-10488", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:54:15.168Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10488", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T15:54:03.652256Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:54:09.339Z"}}], "cna": {"title": "Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move", "credits": [{"lang": "en", "type": "finder", "value": "Arkadiusz Hydzik"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}}], "affected": [{"vendor": "wpwax", "product": "Directorist: AI-Powered Business Directory, Listings & Classified Ads", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.4.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-10T19:26:15.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-24T17:34:40.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2249ef72-9955-4636-b32f-e88720923268?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/directorist/tags/8.4.5/includes/classes/class-add-listing.php#L634"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3377181%40directorist&new=3377181%40directorist&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficient file path validation in the add_listing_action AJAX action in all versions up to, and including, 8.4.8. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:39.661Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10488", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:41:39.661Z", "dateReserved": "2025-09-15T14:42:08.792Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-25T06:49:21.186Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Directorist: AI-Powered Business Directory, Listings & Classified Ads", "vendor": "wpwax", "versions": [{"lessThanOrEqual": "8.4.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficient file path validation in the add_listing_action AJAX action in all versions up to, and including, 8.4.8. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php)."}, {"lang": "es", "value": "El plugin Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings para WordPress es vulnerable a movimiento arbitrario de archivos debido a validaci\u00f3n insuficiente de la ruta de archivo en la acci\u00f3n AJAX add_listing_action en todas las versiones hasta la 8.4.8, inclusive. Esto hace posible que atacantes no autenticados muevan archivos arbitrarios en el servidor, lo que puede conducir f\u00e1cilmente a ejecuci\u00f3n remota de c\u00f3digo cuando se mueve el archivo correcto (como wp-config.php)."}], "id": "CVE-2025-10488", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10488", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-27T15:54:03.652256Z", "version": "2.0.3"}}]}, "published": "2025-10-25T07:15:37.323", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/directorist/tags/8.4.5/includes/classes/class-add-listing.php#L634"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3377181%40directorist&new=3377181%40directorist&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2249ef72-9955-4636-b32f-e88720923268?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:51:22.101182+00:00", "value": {"mitigation_remediation": ["Upgrade the Directorist plugin to a version newer than 8.4.8 that fixes the file\u2011path validation bug.", "If an upgrade is not immediately possible, restrict or disable the add_listing_action AJAX endpoint for unauthenticated users or restrict its allowed file paths to prevent arbitrary file movement.", "After applying a fix or restriction, verify that crucial files such as \"wp-config.php\" are not writable by the web server and review file permissions to mitigate the risk of unauthorized changes."], "summary": {"action": "Apply Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the Directorist AI\u2011Powered Business Directory plugin from wpwax, any release version up to and including 8.4.8 are affected. The vulnerability is present in all documented versions of the plugin up to that point.", "description_and_impact": "The Directorist plugin for WordPress is vulnerable to an arbitrary file move due to insufficient file path validation in the add_listing_action AJAX request. An attacker can instruct the server to move any file on the hosting file system, which can lead to remote code execution if a critical file such as \"wp-config.php\" is moved into a web\u2011accessible location. The weakness matches CWE-22 because the plugin allows path traversal.", "risk_and_exploitability": "This flaw carries a CVSS score of 8.1 and an EPSS score of less than 1\u202f%. It is not currently listed in the CISA KEV catalog. The description indicates that unauthenticated users can exploit the flaw, whereas the CVE title suggests subscriber\u2011level authentication may be required; the precise required privileges remain unclear. If an attacker succeeds, they can move arbitrary files on the server, enabling remote code execution by displacing a malicious script into a web\u2011reachable directory or by altering configuration files."}}}}, "created": "2025-10-27T22:10:12.578304+00:00", "updated": "2026-04-22T22:00:18.077057+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpwax", "wpwax$PRODUCT$directorist"]}