CVE-2022-2376
Directorist < 7.3.1 - Unauthenticated Email Address Disclosure
Vexday Risk Score
18Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 1.4%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
05 Sep 2022Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users
Affected products
Unknown · Directorist – WordPress Business Directory Plugin with Classified Ads ListingsWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →