Introduction
Moving a single file can result in a complete compromise of a WordPress site running the Directorist plugin. CVE-2025-10488, reported in October 2025, shows how insufficient path validation in a widely used business directory plugin exposes thousands of sites to remote code execution. Directorist, developed by wpwax, is an AI-powered business directory and classified ads plugin for WordPress with over 10,000 active installations and more than 676,000 downloads. Because it is popular in the directory and listing space, a flaw in its code reaches a broad range of organizations.
Technical information
CVE-2025-10488 is a high-severity arbitrary file move vulnerability in the Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings for WordPress, affecting all versions up to and including 8.4.8. The flaw sits in the add_listing_action AJAX action, which processes user input for listing management. The plugin does not properly validate or sanitize file path parameters supplied by users. Attackers can include path traversal sequences such as ../ in the file path and move files to locations outside the intended directory. This is a textbook example of CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
An attacker sends a crafted HTTP POST request to the WordPress admin-ajax.php endpoint, specifying the add_listing_action action and including malicious path parameters. The vulnerability does not require authentication, so any remote attacker can exploit it. The worst case is moving a critical file like wp-config.php, which can force the site into setup mode or let attackers take control of the installation. The root cause is that the plugin performs file move operations without first canonicalizing the input paths or checking that they stay within allowed locations.
Public code references confirm the flaw. In version 8.4.5, the vulnerable function is in class-add-listing.php at line 634:
// Reference only. Do not use this code in production. move_uploaded_file( $_FILES['file']['tmp_name'], $target_path );
User input can manipulate $target_path here, and no adequate sanitization stops it from traversing outside the intended directory.
Affected systems and versions
The vulnerability affects the following product and versions:
- Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings for WordPress
- All versions up to and including 8.4.8
Version 8.4.9 patches the vulnerability, so sites running 8.4.9 or later are not affected.
Vendor security history
Directorist, maintained by wpwax, has a documented history of security issues. Public vulnerability databases and advisories list at least 17 vulnerabilities in the plugin since 2021, including missing authorization, arbitrary file upload, file deletion, and information disclosure. Multiple vulnerabilities trace back to improper input validation and authorization checks, which points to recurring problems in secure coding practice. The vendor has generally responded with patches, but the frequency and similarity of the issues suggest it needs more comprehensive security reviews and process improvements.
