PT-2025-6428 · WordPress · Adirectory

Peter Thaleikis · Published 2025-02-12 · Updated 2025-02-25 · CVE-2024-13541

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions aDirectory – WordPress Directory Listing Plugin versions prior to 2.3

Description The issue is related to a missing capability check on the adqs delete listing() function, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary posts, resulting in unauthorized loss of data.

Recommendations For versions prior to 2.3, update to a version that includes a fix for the missing capability check on the adqs delete listing() function. As a temporary workaround, consider restricting access to the adqs delete listing() function to prevent unauthorized post deletion.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-13541

Affected Products

Adirectory

References · 12

• https://osv.dev/vulnerability/CVE-2024-13541 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3235167%40adirectory&new=3235167%40adirectory&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-13541 · Security Note
• https://t.me/cvedetector/17808 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c99b8a94-c35b-43a1-bb14-2ca97be421cc?source=cve · Note
• https://plugins.trac.wordpress.org/browser/adirectory/tags/2.1/inc/Frontend/Ajax.php#L113 · Note
• https://t.me/cvenotify/110989 · Telegram Post
• https://twitter.com/CVEnew/status/1889761669708128418 · Twitter Post
• https://plugins.trac.wordpress.org/browser/adirectory/tags/1.3.4/inc/Frontend/Ajax.php#L115 · Note
• https://plugins.trac.wordpress.org/browser/adirectory/tags/1.9.5/inc/Frontend/Ajax.php#L115 · Note
• https://twitter.com/VulmonFeeds/status/1889655159606665409 · Twitter Post
• https://t.me/cvenotify/112380 · Telegram Post