Unauthorized Order Creation in Directorist WordPress Plugin

Executive Summary

This vulnerability affects the Directorist WordPress plugin versions 8.9.1 to 8.9.4. It allows users with the subscriber role or higher to exploit the REST Orders endpoint to create fake paid orders and payment records with arbitrary amounts, which can be attributed to other users. This happens because the plugin does not properly check user capabilities when creating orders through its REST API.

Useful 0 Not Useful 0

Detection Guidance

Check if your Directorist plugin version is between 8.9.1 and 8.9.4. Use WordPress admin dashboard or run a command like 'wp plugin list' in the WordPress directory to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

An attacker could create fake paid orders and payments with any amount, assigning them to other users. This could lead to financial discrepancies, fraudulent transactions, or reputational damage if the plugin is used for business transactions. Users with subscriber roles or higher could manipulate order records without proper authorization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized creation of financial records, potentially violating data integrity and audit requirements in GDPR and HIPAA. Fake transactions may lead to incorrect financial reporting, which could breach regulatory standards for accurate record-keeping and user consent.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Directorist plugin to version 8.9.5 or later immediately. Disable the REST Orders endpoint if an update is not possible. Review recent orders for suspicious activity.

Useful 0 Not Useful 0