Vulnerabilities > CVE-2024-13541 - Missing Authorization vulnerability in Adirectory

047910
CVSS 5.4 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
NONE
Integrity impact
LOW
Availability impact
LOW
network
low complexity
adirectory
CWE-862
NVD
Published: 2025-02-12
Updated: 2025-02-25

Summary

The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the adqs_delete_listing() function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.

Vulnerable Configurations

Part Description Count
Application
Adirectory
1

Common Weakness Enumeration (CWE)

References