Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.8.2 - Authenticated (Subscriber+) PHP Object Injection

This plan targets a PHP Object Injection vulnerability in Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.8.2. The vulnerability exists because the plugin's AJAX handler deserializes a user-provided parameter without proper validation.

1. Vulnerability Summary

• ID: CVE-2026-59518
• Type: PHP Object Injection (POI)
• Vulnerable Component: ATBDP_Ajax_Handler class.
• Sink: maybe_unserialize() (which calls unserialize()).
• Condition: Authenticated user (Subscriber level or higher) and a valid AJAX nonce.
• Root Cause: The plugin handles listing field requests via AJAX and accepts an args parameter that is directly passed to maybe_unserialize().

2. Attack Vector Analysis

• Endpoint: http://<target>/wp-admin/admin-ajax.php
• AJAX Action: atbdp_get_listing_type_fields
• Vulnerable Parameter: args
• Authentication: Required (Subscriber level is sufficient).
• Nonce: Required (atbdp_nonce).

3. Code Flow

The execution path from entry point to sink is as follows:

1. AJAX Registration: In includes/classes/class-ajax-handler.php, the action is registered:

   add_action( 'wp_ajax_atbdp_get_listing_type_fields', [ $this, 'atbdp_get_listing_type_fields' ] );
   

2. Method Execution: The atbdp_get_listing_type_fields method is called.
3. Nonce Check: It verifies the nonce:

   check_ajax_referer( 'atbdp_nonce', 'atbdp_nonce' );
   

4. Vulnerable Sink: It retrieves the args POST parameter and passes it to maybe_unserialize():

   $args = isset( $_POST['args'] ) ? maybe_unserialize( stripslashes( $_POST['args'] ) ) : array();
   

5. Deserialization: Since maybe_unserialize detects the serialized string format (e.g., O:8:"stdClass":0:{}), it executes unserialize(), triggering any __wakeup or __destruct magic methods in available POP chains.

4. Nonce Acquisition Strategy

The nonce is localized in the atbdp_common JavaScript object. To obtain it as a Subscriber:

1. Login: Authenticate as a Subscriber.
2. Page Navigation: Navigate to a page where Directorist enqueues its common scripts. The "Add Listing" page is the most reliable source.
3. Shortcode Setup: If no such page exists, create one with the [directorist_add_listing] shortcode.
4. Extraction: Use browser_eval to extract the nonce from the global window object.
   • JS Object: window.atbdp_common
   • Nonce Key: atbdp_nonce

5. Exploitation Strategy

1. Setup: Create a Subscriber user and ensure a page with the Directorist shortcode exists.
2. Identify Nonce:
   • Access the page with the shortcode.
   • Extract atbdp_common.atbdp_nonce.
3. Craft Payload: Use a generic serialized object to confirm injection. Since no POP chain is confirmed in the plugin, a dummy object like O:8:"stdClass":0:{} is sufficient for the PoC, or a known WordPress core gadget if available (e.g., Requests_Utility_FilteredIterator).
4. Execute Request:
   • URL: http://<target>/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     action=atbdp_get_listing_type_fields&atbdp_nonce=<NONCE>&args=<SERIALIZED_PAYLOAD>
     

6. Test Data Setup

1. User: wp user create attacker attacker@example.com --role=subscriber --user_pass=password
2. Page: wp post create --post_type=page --post_title="Submit Listing" --post_status=publish --post_content='[directorist_add_listing]'
3. Settings: Ensure "Directorist" is active.

7. Expected Results

• Success: The server processes the request and returns a 200 OK response.
• Confirmation: If a payload designed to trigger an error or a specific behavior (like O:20:"NonExistentPoCClass":0:{}) is sent, the PHP error log (if enabled) will show "Class 'NonExistentPoCClass' not found" or "The script tried to execute a method or access a property of an incomplete object," confirming the unserialize() call was reached.

8. Verification Steps (Post-Exploit)

1. Check Logs: Monitor wp-content/debug.log for deserialization errors.
2. Blind Verification: Use an OAST (Out-of-band) gadget if the environment allows DNS/HTTP egress to verify code execution (requires a valid POP chain).
3. Code Audit: Use wp-cli to verify the code path exists in the current version:

   grep -rn "maybe_unserialize( stripslashes( \$_POST\['args'\] ) )" wp-content/plugins/directorist/
   

9. Alternative Approaches

If atbdp_get_listing_type_fields is inaccessible, try these alternative AJAX actions which often exhibit similar patterns in Directorist:

• atbdp_get_custom_fields (parameter args)
• atbdp_search_result_save (parameter search_data)
• atbdp_tax_listing_fields (parameter args)

Always use the atbdp_nonce found in the localized script data for these actions.