Directorist < 7.0.6.2 - Cross-Site Request Forgery to Arbitrary File Upload

highseverity

8.8CVSS score

2.3%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

The Directorist plugin for WordPress before 7.0.6.2 does not verify a CSRF nonce on its front-end listing submission handler (the add_listing_action AJAX action, registered for unauthenticated users via wp_ajax_nopriv). An attacker can forge a listing submission - including file uploads - on behalf of a logged-in user, leading to arbitrary file upload and potential remote code execution. The fix adds directorist_verify_nonce() to atbdp_submit_listing(). This template detects the missing nonce check by sending a listing submission with no nonce: a vulnerable build processes it (failing later at field validation) while a patched build rejects it at the nonce gate.

Impact

Cross-site request forgery allowing arbitrary file upload, which can lead to remote code execution on the server.

Fix

Update Directorist to 7.0.6.2 or later, which verifies the directorist nonce before processing a listing submission.

How to confirm it

Send: POST /wp-admin/admin-ajax.php?action=add_listing_action
Positive when: contains "\"error_msg\"" and "Something Wrong with Your Submission" AND not contains "nonce did not verify" AND status 200

Run it with nuclei: nuclei -id CVE-2021-24981 -u <target>

The full check

id: CVE-2021-24981

info:
  name: Directorist < 7.0.6.2 - Cross-Site Request Forgery to Arbitrary File Upload
  author: DhiyaneshDk
  severity: high
  description: |
    The Directorist plugin for WordPress before 7.0.6.2 does not verify a CSRF nonce on its front-end listing submission handler (the add_listing_action AJAX action, registered for unauthenticated users via wp_ajax_nopriv). An attacker can forge a listing submission - including file uploads - on behalf of a logged-in user, leading to arbitrary file upload and potential remote code execution. The fix adds directorist_verify_nonce() to atbdp_submit_listing(). This template detects the missing nonce check by sending a listing submission with no nonce: a vulnerable build processes it (failing later at field validation) while a patched build rejects it at the nonce gate.
  impact: |
    Cross-site request forgery allowing arbitrary file upload, which can lead to remote code execution on the server.
  remediation: |
    Update Directorist to 7.0.6.2 or later, which verifies the directorist nonce before processing a listing submission.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24981
    - https://github.com/advisories/GHSA-g47h-745c-4p4f
    - https://wpscan.com/vulnerability/4c45df6d-b3f6-49e5-8b1f-edd32a12d71c/
    - https://plugins.trac.wordpress.org/changeset?old_path=/directorist/tags/7.0.6.1&new_path=/directorist/tags/7.0.6.2
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2021-24981
    epss-score: 0.00837
    epss-percentile: 0.58079
    cwe-id: CWE-352
  metadata:
    verified: true
    max-request: 1
    vendor: wpwax
    product: directorist
    framework: wordpress
    publicwww-query: "/wp-content/plugins/directorist/"
  tags: cve,cve2021,wordpress,wp-plugin,directorist,csrf,file-upload,vkev

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=add_listing_action HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        directory_type=&listing_title={{rand_text_alpha(6)}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"error_msg"'
          - 'Something Wrong with Your Submission'
        condition: and

      - type: word
        part: body
        words:
          - 'nonce did not verify'
        negative: true

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from