Description
The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/4c45df6d-b3f6-49e5-8b1f-edd32a12d71c
Exploit, Third Party Advisory x_refsource_misc
https://blog.sucuri.net/2021/11/fake-ransomware-infection-spooks-website-owners.html
Scores
CVSS v3
7.5
EPSS
0.0022
EPSS Percentile
44.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2021-11-16
Ransomware Use
Confirmed
CWE
CWE-434
CWE-352
Status
published
Products (1)
wpwax/directorist
< 7.0.6.2
Published
Dec 21, 2021
Tracked Since
Feb 18, 2026