CVE-2022-2046

PoC —

CVSS 3.1

4.9 medium

EPSS

<1%p59

Published

Aug 8, 2022 (Aug 8, 2022)

Modified

Jun 17, 2026

Description

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.

Vendors: wpwax
Products: directorist
Ecosystems: WordPress
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.