CVE-2022-2046

🗓️ 08 Aug 2022 13:46:03Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 58 Views🌐 WEB

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site without URL domain check, potentially enabling code execution

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2022-2046	8 Aug 202214:15	–	attackerkb
CNNVD	WordPress Plugin Discy 代码问题漏洞	8 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-2046 Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload	8 Aug 202213:46	–	cvelist
EUVD	EUVD-2022-34349	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2046	8 Aug 202214:15	–	nvd
Patchstack	WordPress Directorist plugin <= 7.2.2 - Authenticated Arbitrary File Upload vulnerability	18 Jul 202200:00	–	patchstack
Prion	Code injection	8 Aug 202214:15	–	prion
Positive Technologies	PT-2022-14679 · WordPress · Directorist	8 Aug 202200:00	–	ptsecurity
RedhatCVE	CVE-2022-2046	22 May 202522:20	–	redhatcve
wpexploit	Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload	18 Jul 202200:00	–	wpexploit

NVD

Vulners

Node

wpwax directoristRange<7.2.3wordpress

[
  {
    "product": "Directorist – WordPress Business Directory Plugin with Classified Ads Listings",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "7.2.3",
        "status": "affected",
        "version": "7.2.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/03a04eab-be47-4195-af77-0df2a32eb807
plugins	www.plugins.trac.wordpress.org/changeset/2752034/directorist

Parameter	Position	Path	Description	CWE
download_item[download_link]	request body	wp-admin/admin-ajax.php	Administrators can download and install plugins from an untrusted source without validating the URL domain, enabling potentially malicious code execution in multisite setups.	CWE-434

17 Jun 2026 04:41Current

5.1Medium risk

Vulners AI Score5.1

CVSS 3.14.9

EPSS0.00764

CWE-434