CVE-2022-2377

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.36% chance of exploitation in the next 30 days, 29th percentile

Published

2022-08-22

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/f4e606e9-0664-42fb-a59b-21de306eb530

References

• CVE Record
• NVD entry

Related

• CVE-2022-2376
• CVE-2022-23773
• CVE-2022-2375
• CVE-2022-23779
• CVE-2022-2374
• CVE-2022-2378