PT-2022-16256 · WordPress · Directorist

Krzysztof Zając · Published 2022-08-22 · Updated 2023-06-30 · CVE-2022-2377

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Directorist WordPress plugin versions prior to 7.3.0

Description The issue concerns a lack of authorization and CSRF checks in an AJAX action within the Directorist WordPress plugin. This allows any authenticated users to send arbitrary emails on behalf of the blog.

Recommendations For versions prior to 7.3.0, update to version 7.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the AJAX action until a patch is applied.

Exploit

Fix

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2022-2377

Affected Products

Directorist

References · 4

• 🔥 https://wpscan.com/vulnerability/f4e606e9-0664-42fb-a59b-21de306eb530 · Exploit
• https://osv.dev/vulnerability/CVE-2022-2377 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2377 · Security Note
• https://t.me/cvenotify/35124 · Telegram Post