CVE-2022-2377 Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending

2022-08-2215:02:09

CWE-862

CWE-352

WPScan

www.cve.org

cve-2022-2377; directorist wordpress plugin; arbitrary e-mail sending; ajax action; authorisation; csrf checks; authenticated users; arbitrary emails

AI Score

Confidence

High

EPSS

0.001

Percentile

21.2%

JSON

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog

CNA Affected

[
  {
    "product": "Directorist – WordPress Business Directory Plugin with Classified Ads Listings",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "7.3.0",
        "status": "affected",
        "version": "7.3.0",
        "versionType": "custom"
      }
    ]
  }
]