CVE-2022-2046

 

Published at: - 08-08-2022 04:15

Last modified: - 12-08-2022 05:19

Total changes: - 2

Description

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://wpscan.com/vulnerability/03a04eab-be47-4195-af77-0df2a32eb807
• https://plugins.trac.wordpress.org/changeset/2752034/directorist?contextall=1&old=2731298&old_path=%2Fdirectorist

 

Keywords

NVD

 

CVE-2022-2046

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures