Medium severity4.9NVD Advisory· Published Aug 8, 2022· Updated Jun 17, 2026

CVE-2022-2046

Description

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wpwax/Directorist
cpe:2.3:a:wpwax:directorist:*:*:*:*:*:wordpress:*:*
Range: <7.2.3
WordPress/Directoristcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <7.2.3
Package: https://wordpress.org/plugins/directorist

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/03a04eab-be47-4195-af77-0df2a32eb807nvdExploitThird Party Advisory
plugins.trac.wordpress.org/changeset/2752034/directoristnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.319
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000