CVE-2022-3930: Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR
Vulnerability summary
CVE-2022-3930 is a high (CVSS 8.8) vulnerability in unknown directorist. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 50.5% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 7.4.2.2.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 12-12-2022PublishedVulnerability first disclosed.
- 22-04-2025Last modifiedVulnerability information updated.
Description
The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NDiffers
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NDiffers
EPSS trend
Probability
0.64%
Chance of exploitation in the next 30 days
Percentile
51%
Versus all other CVEs
30-day change
Increase +0.02 pp
From 0.61% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Unknown1 product
- directorist< 7.4.2.2
Wordpress1 product
- directorist≤ 7.4.2.1 (fixed in 7.4.2.2)
Wpwax1 product
- directorist< 7.4.2.2
3 vendors · 3 products
References
2 links- wpscan.com/vulnerability/8728d02a-51db-4447-a843-0264b6ceb413ExploitVDB EntryTechnical DescriptionThird Party Advisory