CVE-2025-2224 describes a missing authorization vulnerability (CWE-862) in the Directorist WordPress plugin by wpwax. The issue arises from the lack of capability checks in the 'parse_query' function, allowing unauthenticated users to modify the post_status field of posts to 'publish'. This could lead to unauthorized publication of content. The vulnerability affects all versions up to and including 8.2. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker without authentication can update the post_status of any post to 'publish', potentially exposing content that was intended to remain unpublished. The impact is limited to confidentiality as there is no indication of integrity or availability impact. No known exploits are reported, and the vulnerability is rated medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor plugin updates from wpwax and consider restricting access to the affected plugin or disabling it if possible. No vendor advisory or patch links are currently available.