CVE-2023-2252

LOW NUCLEI

Directorist < 7.5.4 - Local File Inclusion via CSV Import File Parameter

Title source: llm

Exploitation Summary

CVE-2023-2252 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The Directorist WordPress plugin before 7.5.4 is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files.

Nuclei Templates (1)

Directorist < 7.5.4 - Local File Inclusion

LOWVERIFIEDby r3Y3r53

References (1)

Core 1

Core References

Exploit, Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/9da6eede-10d0-4609-8b97-4a5d38fa8e69/

Scores

CVSS v3 2.7

EPSS 0.0131

EPSS Percentile 67.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (1)

wpwax/directorist < 7.5.4

Published Jan 16, 2024

Tracked Since Feb 18, 2026