CVE-2026-22337 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-266** (Incorrect Privilege Assignment). 🔍 **Flaw**: The plugin fails to properly verify user permissions, allowing lower-privileged users to execute high-level functions.

Q: Who is affected? (Versions/Components)

📦 **Affected**: WordPress Plugin **Directorist Social Login**. 📉 **Version**: Versions **prior to 2.1.4** are vulnerable. 🏢 **Vendor**: Directorist.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **Low**. 🌐 **Network**: Attack Vector is **Network** (AV:N). 🔑 **Auth**: **No Privileges Required** (PR:N). 👀 **UI**: **No User Interaction** (UI:N). 🎯 **Complexity**: **Low** (AC:L).

Q: Is there a public Exp? (PoC/Wild Exploitation)

🧪 **Exploit**: No public PoC or Exploit code is currently listed in the provided data. ⚠️ **Risk**: Despite no public code, the low exploitation barrier makes it highly susceptible to automated attacks.

Q: How to self-check? (Features/Scanning)

🔍 **Check**: Scan for **Directorist Social Login** plugin. 📊 **Version**: Verify if installed version is **< 2.1.4**. 🛠️ **Tool**: Use WordPress vulnerability scanners or check plugin settings for version info.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fix**: Update the plugin to version **2.1.4 or later**. 📥 **Source**: Official WordPress plugin repository or vendor patchstack link. 🔄 **Action**: Immediate update is the primary mitigation.

Q: Is it urgent? (Priority Suggestion)

🔥 **Priority**: **CRITICAL**. 🚨 **CVSS**: **9.8** (High). ⏳ **Urgency**: Patch immediately. The combination of no auth required and high impact makes this a top-priority target for attackers.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A critical privilege escalation flaw in the Directorist Social Login plugin.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-266** (Incorrect Privilege Assignment). <br>🔍 **Flaw**: The plugin fails to properly verify user permissions, allowing lower-privileged users to execute high-level functions.

Q3Who is affected? (Versions/Components)

📦 **Affected**: WordPress Plugin **Directorist Social Login**. <br>📉 **Version**: Versions **prior to 2.1.4** are vulnerable. <br>🏢 **Vendor**: Directorist.

Q4What can hackers do? (Privileges/Data)

👑 **Privileges**: Attackers gain **High** impact on Confidentiality, Integrity, and Availability.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **Low**. <br>🌐 **Network**: Attack Vector is **Network** (AV:N). <br>🔑 **Auth**: **No Privileges Required** (PR:N). <br>👀 **UI**: **No User Interaction** (UI:N). <br>🎯 **Complexity**: **Low** (AC:L).

Q6Is there a public Exp? (PoC/Wild Exploitation)

🧪 **Exploit**: No public PoC or Exploit code is currently listed in the provided data. <br>⚠️ **Risk**: Despite no public code, the low exploitation barrier makes it highly susceptible to automated attacks.

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for **Directorist Social Login** plugin. <br>📊 **Version**: Verify if installed version is **< 2.1.4**. <br>🛠️ **Tool**: Use WordPress vulnerability scanners or check plugin settings for version info.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fix**: Update the plugin to version **2.1.4 or later**. <br>📥 **Source**: Official WordPress plugin repository or vendor patchstack link. <br>🔄 **Action**: Immediate update is the primary mitigation.

Q9What if no patch? (Workaround)

🚧 **Workaround**: If updating is impossible, **deactivate and delete** the plugin immediately.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Priority**: **CRITICAL**. <br>🚨 **CVSS**: **9.8** (High). <br>⏳ **Urgency**: Patch immediately. The combination of no auth required and high impact makes this a top-priority target for attackers.

Continue exploring

Vulnerability detail Full AI analysis (login) Directorist CWE-266