{"cve":"CVE-2022-2046","nvd":{"published":"2022-08-08T14:15:08.637","modified":"2026-06-17T04:41:11.227","status":"Modified","description":"The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","score":4.9},"cwes":["CWE-434"],"references":["https://plugins.trac.wordpress.org/changeset/2752034/directorist?contextall=1&old=2731298&old_path=%2Fdirectorist","https://wpscan.com/vulnerability/03a04eab-be47-4195-af77-0df2a32eb807","https://plugins.trac.wordpress.org/changeset/2752034/directorist?contextall=1&old=2731298&old_path=%2Fdirectorist","https://wpscan.com/vulnerability/03a04eab-be47-4195-af77-0df2a32eb807"],"products":["wpwax:directorist"],"source":"nvd","synced_at":"2026-10-19T21:34:18.502168378+00:00"},"epss":{"cve":"CVE-2022-2046","score":0.01007,"percentile":0.63037,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}