CVE-2022-2377CWE-352CWE-862

CVE-2022-2377: vulnerability in Directorist – WordPress Business Directory…

Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending

Published · Updated

Follow this CVE+ Monitor Directorist – WordPress Business Directory Plugin with Classified Ads Listings

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.4%
The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog
Affected products
Unknown · Directorist – WordPress Business Directory Plugin with Classified Ads Listings
Related CVEs — Directorist – WordPress Business Directory…

In the same product, most dangerous first.

CVE-2022-2376—Directorist < 7.3.1 - Unauthenticated Email Address DisclosureEPSS 2.0%CVE-2022-2046—Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File UploadEPSS 1.0%