CVE-2025-12174: Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update
Vulnerability summary
CVE-2025-12174 is a medium (CVSS 6.5) Missing Authorization vulnerability in wordpress directorist. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.7% of scored vulnerabilities. Fixed in 8.5.3.
Timeline
- 19-11-2025PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'directorist_prepare_listings_export_file' and 'directorist_type_slug_change' AJAX actions in all versions up to, and including, 8.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export listing details and change the directorist slug.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- wordfenceSource6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.20% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Wordpress1 product
- directorist≤ 8.5.2 (fixed in 8.5.3)
Wpwax1 product
- directorist: ai-powered business directory, listings & classified ads≤ 8.5.2
2 vendors · 2 products