CVE-2022-2376: Directorist < 7.3.1 - Unauthenticated Email Address Disclosure

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-05 · updated 2026-06-17
Weakness: CWE-862

Description

The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users

Affected products

wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads: before 7.3.1 — fixed in 7.3.1

How to fix

Upgrade to a fixed version: wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads 7.3.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/437c4330-376a-4392-86c6-c4c7ed9583ad
https://wpscan.com/vulnerability/437c4330-376a-4392-86c6-c4c7ed9583ad

Get alerted when CVE-2022-2376 or the next vulnerability affects your stack