PT-2022-14837 · WordPress · Name Directory Wordpress Plugin

Donato Di Pasquale · Published 2022-07-25 · Updated 2022-07-29 · CVE-2022-2071

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Name Directory WordPress plugin versions prior to 1.25.4

Description The issue concerns a lack of CSRF check when importing names and inadequate sanitisation and escaping of imported data. This could allow attackers to make a logged-in admin import arbitrary names containing XSS payloads.

Recommendations For versions prior to 1.25.4, update to version 1.25.4 or later to resolve the issue. As a temporary workaround, consider restricting the import functionality to minimize the risk of exploitation. Avoid using the import feature with untrusted data until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-2071

Affected Products

Name Directory Wordpress Plugin

References · 4

• 🔥 https://wpscan.com/vulnerability/d3653976-9e0a-4f2b-87f7-26b5e7a74b9d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2071 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2071 · Vendor Advisory
• https://t.me/cibsecurity/46894 · Telegram Post