CVE-2024-12041
📋 TL;DR
This vulnerability allows unauthenticated attackers to access sensitive user information through the Directorist WordPress plugin's REST API endpoint. All WordPress sites using Directorist plugin versions up to 8.0.12 are affected, exposing usernames, email addresses, and other user data.
💻 Affected Systems
- Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers harvest all user data for phishing campaigns, credential stuffing attacks, or targeted social engineering against administrators and users.
Likely Case
Automated bots scrape user information for spam lists, credential stuffing databases, or reconnaissance for further attacks.
If Mitigated
With proper access controls, only authorized users can access user data, preventing information exposure.
🎯 Exploit Status
Simple HTTP GET requests to the vulnerable endpoint can extract data without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.1 and later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3231156/directorist/tags/8.1/includes/rest-api/Version1/class-users-controller.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Directorist plugin. 4. Click 'Update Now' if available, or download version 8.1+ from WordPress repository. 5. Replace plugin files with patched version.
🔧 Temporary Workarounds
Block REST API Endpoint
linuxAdd .htaccess rule to block access to the vulnerable endpoint
RewriteEngine On
RewriteRule ^wp-json/directorist/v1/users/ - [F,L]
Disable Plugin
allTemporarily disable Directorist plugin until patched
wp plugin deactivate directorist
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests to /wp-json/directorist/v1/users/ endpoint
- Restrict access to WordPress REST API using authentication or IP whitelisting
🔍 How to Verify
Check if Vulnerable:
Send GET request to https://yoursite.com/wp-json/directorist/v1/users/ - if it returns user data without authentication, you're vulnerable.Check Version:
wp plugin get directorist --field=versionVerify Fix Applied:
After update, same GET request should return 401/403 error or no user data without authentication.📡 Detection & Monitoring
Log Indicators:
- Multiple 200 OK responses to /wp-json/directorist/v1/users/ from unauthenticated IPs
- Unusual GET requests to Directorist REST endpoints
Network Indicators:
- Unusual traffic patterns to /wp-json/directorist/v1/users/ endpoint
- Bursts of requests from single IPs to user data endpoints
SIEM Query:
source="web_logs" AND uri="/wp-json/directorist/v1/users/" AND response_code=200 AND NOT auth_status="authenticated"🔗 References
- https://plugins.trac.wordpress.org/changeset/3208874/directorist/tags/8.0.9/includes/rest-api/Version1/class-users-controller.php
- https://plugins.trac.wordpress.org/changeset/3231156/directorist/tags/8.1/includes/rest-api/Version1/class-users-controller.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0d9817ff-ca56-4941-97bc-f26defe7ddd5?source=cve
