The Directorist plugin for WordPress, used for business directories and classified ads, contains a missing capability check in its 'setup_wizard' function in all versions up to 7.8.4. This missing authorization (CWE-862) allows unauthenticated remote attackers to perform unauthorized modifications such as recreating default pages, enabling or disabling monetization, and altering the map provider settings. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium impact primarily on integrity without affecting confidentiality or availability.

An attacker without authentication can modify plugin settings that affect the website's business directory functionality. This includes unauthorized changes to monetization options and map provider configurations, potentially disrupting business operations or causing incorrect data presentation. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's administrative functions and monitor for unauthorized changes. Avoid exposing the plugin setup wizard endpoint to unauthenticated users. Follow updates from the vendor wpwax for an official patch or temporary mitigation.