CVE-2022-2046: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2022-2046) affects the Directorist – Business Directory Plugin versions below 7.2.3 for WordPress. The vulnerability allows administrators to download plugins from the same vendor directly to the site without proper URL domain validation for zip files, which could potentially lead to code execution on the server. This is particularly concerning in multisite configurations (WPScan).

The vulnerability is classified as an Arbitrary File Upload issue that affects administrator-level users. The security flaw exists in the plugin's functionality that handles plugin downloads. When downloading plugins from the vendor, the system fails to validate the domain of the URL from which zip files are retrieved, potentially allowing malicious file uploads (WPScan).

If exploited, this vulnerability could allow authenticated administrators to execute arbitrary code on the server. This is particularly problematic in WordPress multisite configurations where compromising one administrator account could affect multiple sites (WPScan).

The vulnerability has been patched in version 7.2.3 of the Directorist plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).