CVE-2022-2376: Wpwax Directorist

Medium severity, CVSS 5.3. EPSS: 1.8% chance of exploitation in the next 30 days.

The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to both unauthenticated and any authenticated users

Affected products

• Wpwax Directorist: before 7.3.1 (fixed in 7.3.1)

Published 2022-09-05. Last modified 2026-06-17.