CVE-2026-22337: Directorist Social Login (WordPress plugin) Privilege Escalation via Incorrect Privilege Assignment
CVE-2026-22337 is an incorrect privilege assignment flaw (CWE-266) in the Directorist Social Login WordPress plugin that, according to the record, allows privilege escalation. The record lists a CVSS 3.1 base score of 9.8 from the CNA Patchstack and affected versions described as before 2.1.4. The CVE is not listed in CISA KEV in the record, and no confirmed active exploitation appears in the sources consulted.
Overview
This record describes an incorrect privilege assignment flaw (CWE-266) in the Directorist Social Login plugin for WordPress. The description states that it allows privilege escalation. The CNA Patchstack assigned a CVSS 3.1 base score of 9.8 with a vector describing network attack, low complexity, no privileges and no user interaction required.
Impact
- According to the description, an attacker may be able to obtain higher privileges than intended on an affected site.
- The CVSS vector reports high confidentiality, integrity and availability impact with scope unchanged.
- Because the vector requires no privileges and no user interaction, the score suggests that exposure may extend to unauthenticated users on internet-facing sites. This is an inference from the vector.
Affected products and versions
- Product: Directorist Social Login, a WordPress plugin associated with the Directorist vendor.
- The description gives the affected range as from n/a before 2.1.4, meaning versions earlier than 2.1.4 are reported as affected.
- The record contains no structured affected or fixed version entries.
Exploitation status
The record shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed active exploitation appears in the sources consulted for this analysis.
Remediation and mitigation
- Update Directorist Social Login to version 2.1.4 or later, as indicated by the description.
- If an update cannot be applied immediately, review which accounts and roles can be created or modified through social login, and restrict new registrations where practical.
- Consult the Patchstack database entry linked in the references for additional vendor-specific context.
- Keep WordPress core and all plugins current, and review administrator accounts for unexpected changes.
Detection guidance
- Review recent user creation and role changes, especially accounts that received administrative or other elevated roles without an expected administrator action.
- Check authentication and web server logs for unusual social login callbacks or account linking activity.
- Inventory the installed version of the plugin on every WordPress site and identify any installation below 2.1.4.
Limitations of the available information
- The lower bound of the affected range is recorded as n/a, so the earliest affected version is unknown.
- The record does not describe the technical mechanism beyond the CWE classification, and no vendor-supplied patch details are included.
- The EPSS values in the record are shown as reported; their date does not clarify the analysis and should be interpreted with care.
- No structured CPE, affected or fixed version data is present in the record.
Frequently asked questions
What is CVE-2026-22337?
It is an incorrect privilege assignment vulnerability (CWE-266) in the Directorist Social Login WordPress plugin that, according to the record, allows privilege escalation.
Which versions are affected?
The record describes the affected range as from n/a before 2.1.4, so versions earlier than 2.1.4 are reported as affected. The exact lower bound is not stated.
Is this vulnerability being exploited?
The record does not list this CVE in CISA KEV, and no confirmed active exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.