CVE-2025-10488

Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move

8.1 High

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to arbitrary file move due to insufficient file path validation in the add_listing_action AJAX action in all versions up to, and including, 8.4.8. This makes it possible for unauthenticated attackers to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php).

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: High

Exploit likelihood

0.91%Up 0.8 points since Oct 25, 2025

What each source reports

CVE List Score used 8.1

Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move

Record: CVE-2025-10488
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

EUVDEUVD-2025-35929 8.1

Record: EUVD-2025-35929
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-96rr-76h4-x8pf 8.1

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for...

Record: GHSA-96rr-76h4-x8pf
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

NVD 8.1

Record: CVE-2025-10488
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-22
Updated: 2026-11-02

Affected products

wpwax directorist: ai-powered business directory, listings & classified ads

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-10488 is a high vulnerability (CVSS 8.1) in Wpwax Directorist: Ai-powered Business Directory, Listings & Classified Ads, published October 25, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. No source names a fixed version.