CVE-2022-2046

CVE-2022-2046: Directorist - Business Directory Plugin < 7.2.3 - Admin+ Arbitrary File Upload

Vendor Unknown

Product Directorist – WordPress Business Directory Plugin with Classified Ads Listings

Weakness CWE-434 · Unrestricted file upload

Published August 8, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.

Key dates

02Disclosure timeline

August 8, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2046 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2021-34623 ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component CVE-2024-0800 Authentication Bypass via wizardLogin in Arcserve Unified Data Protection CVE-2025-10081 SourceCodester Pet Management System profile.php unrestricted upload CVE-2025-1028 Contact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension Upload CVE-2021-24311 External Media < 1.0.34 - Authenticated Arbitrary File Upload