CVE-2022-3930 Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR
An attacker can change arbitrary user passwords via an IDOR vulnerability in the Directorist WordPress plugin, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-3930?
CVE-2022-3930 is a medium-severity missing authorization vulnerability in Unknown Directorist, published on 12 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own.
Which versions are affected by CVE-2022-3930?
It affects 1 product.
Products include Wpwax Directorist.
How do I fix CVE-2022-3930?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-3930 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3930 exists.
Other vulnerabilities in Unknown Directorist
- CVE-2023-1888 Directorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege Escalation
- CVE-2025-1570 Auth bypass in Directorist: AI-Powered Business Directory, Listings & Classified Ads
- CVE-2021-24981 Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File Upload
- CVE-2023-1889 Missing authorization in Directorist: AI-Powered Business Directory, Listings & Classified Ads
- CVE-2022-3961 Directorist < 7.4.4 - Subscriber+ Sensitive Information Disclosure
Sources
Also known as GHSA-xv2w-x5xm-9j74.