CVE-2022-2376

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	Directorist – WordPress Business Directory Plugin with Classified Ads Listings	>= 7.3.1, < 7.3.1

References

https://wpscan.com/vulnerability/437c4330-376a-4392-86c6-c4c7ed9583adExploit, Third Party Advisory
https://wpscan.com/vulnerability/437c4330-376a-4392-86c6-c4c7ed9583adExploit, Third Party Advisory

Timeline

Published: Sep 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237638.8Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers c CVE-2022-237649.8The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass CVE-2022-237658.8This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS CVE-2022-237668.8An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary f CVE-2022-237679.8This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during fil CVE-2022-237689.8This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to i CVE-2022-237699.8Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vul CVE-2022-23774.3The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated user CVE-2022-237709.8This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructo CVE-2022-237718.8This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploited CVE-2022-237727.5Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption.CVE-2022-237737.5cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to