1. Home
  2. CVE Database
  3. CVE-2022-2046
MEDIUM · 4.9

CVE-2022-2046

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. T...

Vulnerability Description

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.

CVSS Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
WpwaxDirectorist< 7.2.3

Related Weaknesses (CWE)

CWE-434

References

FAQ

What is CVE-2022-2046?

CVE-2022-2046 is a vulnerability with a CVSS score of 4.9 (MEDIUM). The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. T...

How severe is CVE-2022-2046?

CVE-2022-2046 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-2046?

Check the references section above for vendor advisories and patch information. Affected products include: Wpwax Directorist.