Medium severity4.3NVD Advisory· Published Feb 12, 2025· Updated Jun 17, 2026

CVE-2024-13541

Description

The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the adqs_delete_listing() function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary posts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Adirectory/Adirectory
cpe:2.3:a:adirectory:adirectory:*:*:*:*:*:wordpress:*:*
Range: <2.3.5
WordPress/Adirectoryllm-fuzzy
Range: <=2.3
Package: https://wordpress.org/plugins/adirectory
adirectory/aDirectory – WP Business Directory Plugin and Classified Ads Listings Directoryv5
Range: 0
WordPress/Adult Directorywp-canonicalize

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changesetnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/c99b8a94-c35b-43a1-bb14-2ca97be421ccnvdThird Party Advisory
plugins.trac.wordpress.org/browser/adirectory/tags/1.3.4/inc/Frontend/Ajax.phpnvdProduct
plugins.trac.wordpress.org/browser/adirectory/tags/1.9.5/inc/Frontend/Ajax.phpnvdProduct
plugins.trac.wordpress.org/browser/adirectory/tags/2.1/inc/Frontend/Ajax.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000