CVE-2022-2377

Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog

Affected

Directorist – WordPress Business Directory Plugin with Classified Ads Listings

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.36% chance of exploitation in the next 30 days, 29th percentile

Published

2022-08-22

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/f4e606e9-0664-42fb-a59b-21de306eb530

References

• CVE Record
• NVD entry