CVE-2022-2377

MEDIUM

Directorist < 7.3.0 - Authenticated Arbitrary Email Sending via AJAX Action

Title source: llm
STIX 2.1

Description

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/f4e606e9-0664-42fb-a59b-21de306eb530

Scores

CVSS v3 4.3
EPSS 0.0031
EPSS Percentile 22.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-352 CWE-862
Status published
Products (1)
wpwax/directorist < 7.3.0
Published Aug 22, 2022
Tracked Since Feb 18, 2026