CVE-2024-1322 — Missing Authorization in Directorist

CWE-862 — Missing AuthorizationCWE-1322 — Use of Blocking Code in Single-threaded, Non-blocking Context4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.2%
top 53.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Wpwax Directorist
Timeline
PublishedFeb 29

Description

The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 7.8.4. This makes it possible for unauthenticated attackers to recreate default pages and enable or disable monetization and change map provider.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages1 packages

▶NVDwpwax/directorist< 7.8.5

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-9rc5-c3w5-75v5: The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of↗2024-02-29
▶
CVEList
Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change↗2024-02-20
▶
CVE-2024-1322 — Missing Authorization in Directorist | cvebase