CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Directorist plugin for WordPress is vulnerable to an arbitrary user password reset in versions up to, and including, 7.5.4. This is due to a lack of validation checks within login.php. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to reset the password of an arbitrary user and gain elevated (e.g., administrator) privileges.
Explanation of Vulnerability in Simple Terms
Directorist versions up to 7.5.4 contain an input validation flaw that allows authenticated users with low privileges to read sensitive data, modify site content, or disrupt service. The vulnerability stems from insufficient input sanitization in a core function. An attacker with a basic user account can exploit this without user interaction to compromise confidentiality, integrity, and availability of the site.
What an attacker can do
Read sensitive data, modify content, or disrupt the site's availability.
Potential impact on your site
User data, site content, and service availability are at risk if the site runs an affected Directorist version.
Conditions required to exploit
Attacker needs a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
