{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22337", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-07T12:21:11.735Z", "datePublished": "2026-04-27T10:31:04.017Z", "dateUpdated": "2026-04-28T16:14:41.031Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Directorist Social Login", "vendor": "Directorist", "versions": [{"changes": [{"at": "2.1.4", "status": "unaffected"}], "lessThan": "2.1.4", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "0xd4rk5id3 | Patchstack Bug Bounty Program"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.<p>This issue affects Directorist Social Login: from n/a before 2.1.4.</p>"}], "value": "Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4."}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "description": "CWE-266 Incorrect Privilege Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:41.031Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/directorist-social-login/vulnerability/wordpress-directorist-social-login-plugin-2-1-1-privilege-escalation-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the WordPress Directorist Social Login plugin to the latest available version (at least 2.1.4)."}], "value": "Update the WordPress Directorist Social Login plugin to the latest available version (at least 2.1.4)."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress Directorist Social Login plugin < 2.1.4 - Privilege Escalation vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T10:56:29.660684Z", "id": "CVE-2026-22337", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T10:59:13.014Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22337", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-27T10:56:29.660684Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T10:59:09.427Z"}}], "cna": {"title": "WordPress Directorist Social Login plugin < 2.1.4 - Privilege Escalation vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "0xd4rk5id3 | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Directorist", "product": "Directorist Social Login", "versions": [{"status": "affected", "changes": [{"at": "2.1.4", "status": "unaffected"}], "version": "n/a", "lessThan": "2.1.4", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress Directorist Social Login plugin to the latest available version (at least 2.1.4).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress Directorist Social Login plugin to the latest available version (at least 2.1.4).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/directorist-social-login/vulnerability/wordpress-directorist-social-login-plugin-2-1-1-privilege-escalation-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4.", "supportingMedia": [{"type": "text/html", "value": "Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.<p>This issue affects Directorist Social Login: from n/a before 2.1.4.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "CWE-266 Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:41.031Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22337", "state": "PUBLISHED", "dateUpdated": "2026-04-28T16:14:41.031Z", "dateReserved": "2026-01-07T12:21:11.735Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-04-27T10:31:04.017Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allows Privilege Escalation.This issue affects Directorist Social Login: from n/a before 2.1.4."}], "id": "CVE-2026-22337", "lastModified": "2026-04-27T18:37:59.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-04-27T11:16:01.513", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/directorist-social-login/vulnerability/wordpress-directorist-social-login-plugin-2-1-1-privilege-escalation-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Directorist Social Login", "source": "cna", "vendor": "Directorist"}, "product": "directorist_social_login", "vendor": "directorist"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-28T13:05:52.846467+00:00", "value": {"mitigation_remediation": ["Update the Directorist Social Login plugin to version 2.1.4 or later.", "If an immediate update is not possible, disable the plugin until the fix is applied.", "Monitor site logs for attempts to exploit privilege assignments and restrict administrative access to trusted users."], "summary": {"action": "Apply Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The Directorist Social Login plugin for WordPress, versions older than 2.1.4, is affected. Any WordPress installation that has a pre\u20112.1.4 version of the plugin enabled is at risk.", "description_and_impact": "A flaw in the Directorist Social Login plugin for WordPress permits an attacker to incorrectly assign privileges, allowing them to elevate their permissions beyond the intended scope. The vulnerability is rooted in improper privilege management and could be exploited to gain administrative rights on the affected site. The weakness is classified as CWE-266.", "risk_and_exploitability": "The CVSS score is 9.8, indicating a critical severity. The EPSS score is less than 1\u202f%, suggesting a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the web interface of a WordPress site that has the vulnerable plugin installed, where an adversary could exploit the privilege escalation to gain higher access. While the concrete exploitation steps are not detailed in the description, the nature of privilege escalation implies that once the plugin is compromised, an attacker could execute privileged actions that threaten confidentiality, integrity, and availability of site data."}}}}, "created": "2026-04-28T09:17:14.134082+00:00", "updated": "2026-04-28T13:15:31.875089+00:00", "vendors": ["directorist", "directorist$PRODUCT$directorist_social_login", "wordpress", "wordpress$PRODUCT$wordpress"]}