CVE-2022-2046CWE-434

Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload

published August 8, 2022

CVSS
—
EPSS
1%
Percentile
61.5
In the wild
Unconfirmed
What it is

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00969 · 61.5th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2022-08-08T13:46Z
EPSS history
Timeline
  • 08 AUG 13:46Z
    Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload
    cvelistv5