Unauthenticated Access to User Favorites in Directorist WordPress Plugin

Executive Summary

This is an Insecure Direct Object Reference (IDOR) flaw in the Directorist WordPress plugin before version 8.9.5. It allows any authenticated user with subscriber-level access or higher to read and modify another user's saved favorites via the REST Favorites endpoint. The plugin fails to verify that the target user of a REST route matches the authenticated caller, enabling unauthorized cross-user access.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Directorist plugin version prior to 8.9.5. You can verify the installed version via the WordPress admin panel under Plugins or by inspecting the plugin files. Additionally, monitor REST API requests to the Favorites endpoint for unauthorized access attempts.

Useful 0 Not Useful 0

Impact Analysis

If you use the Directorist plugin on your WordPress site, an attacker with subscriber access could view or alter your saved favorites without permission. This could lead to data exposure, unauthorized changes, or potential misuse of user data stored in favorites.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing or altering personal data without consent. For HIPAA, if user favorites contain protected health information, unauthorized access could breach compliance. Organizations must address this to maintain data integrity and regulatory adherence.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Directorist plugin to version 8.9.5 or later. If updating is not possible, consider disabling the plugin temporarily until the update is applied. Review user permissions to ensure no unauthorized access has occurred and monitor for suspicious activity.

Useful 0 Not Useful 0