CVE-2025-12174

The Directorist plugin's security has been compromised by a critical oversight affecting all versions prior to 8.5.3. Specifically, insufficient permission checks on two specific AJAX actions have created an opening for attackers with Subscriber level clearance or higher to execute unauthorized operations. This includes exporting sensitive listing data and modifying the directorist slug without proper authorization.

Based on public CVE data (MITRE/NVD).