{"id":"CVE-2023-35052","published":"2024-12-13T14:23:39Z","modified":"2026-04-28T16:08:29Z","title":"WordPress Directorist plugin <= 7.5.4 - Arbitrary Content Deletion vulnerability","vendor":"wpWax - WP Business Directory Plugin and Classified Listings Directory","product":"Directorist","tier":"tail","description":{"text":"Missing Authorization vulnerability in wpWax - WP Business Directory Plugin and Classified Listings Directory Directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through 7.5.4.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0039,"percentile":0.33023,"provenance":"source"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/directorist/vulnerability/wordpress-directorist-plugin-7-5-4-arbitrary-content-deletion?_s_id=cve","tags":["vdb-entry"]}],"priority":{"score":9.6,"factors":[{"name":"EPSS percentile","points":6.6},{"name":"CVSS severity","points":3.01}]},"vendorSlug":"wpwax-wp-business-directory-plugin-and-classified-listings-directory","affectedVersions":[{"vendor":"wpWax - WP Business Directory Plugin and Classified Listings Directory","product":"Directorist","versions":["<= 7.5.4"]}],"euvd":{"id":"EUVD-2023-39088","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-wpwax-directorist-ai-powered-business-di-cve-2023-1889","children":[{"from":"CVE-2023-35052","to":"CVE-2026-84098","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"This is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release.","from":"CVE.org","in":"CVE-2026-84098"}]}]}}