CVE-2026-22337: 
WordPress vulnerability analysis and mitigation

CVE-2026-22337 is an Incorrect Privilege Assignment vulnerability in the Directorist Social Login WordPress plugin that allows unauthenticated remote attackers to escalate privileges. It affects all versions of Directorist Social Login before 2.1.4. The vulnerability was reported by researcher 0xd4rk5id3 in November 2025, disclosed by Patchstack on January 20, 2026, and published to the NVD on April 27, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Patchstack, GitHub Advisory).

The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment), meaning the plugin incorrectly assigns elevated privileges to an actor during the social login flow, creating an unintended sphere of control. An unauthenticated remote attacker can exploit this over the network with low complexity and no user interaction required, likely by manipulating the social login authentication process to assume administrative or elevated roles. No detailed technical write-up or public proof-of-concept code has been identified at this time (Patchstack, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to escalate privileges and potentially gain full administrative control of the affected WordPress site, resulting in high impact to confidentiality, integrity, and availability. An attacker with administrative access could install malicious plugins, exfiltrate sensitive user data, deface the site, or use the compromised site as a pivot point for further attacks against connected systems or users (Patchstack, GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.041–0.059%, placing it in the 19th percentile for exploitation likelihood within 30 days. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the lack of known exploitation, Patchstack classifies it as high priority due to the critical CVSS score and the potential for mass-exploit campaigns targeting WordPress plugins (Patchstack, GitHub Advisory).

• Logs: WordPress authentication logs showing new administrator or high-privilege account creation without corresponding legitimate user registration; unexpected social login events from unknown or suspicious OAuth providers.
• File System: Newly installed or modified WordPress plugins or themes not authorized by site administrators; unexpected changes to wp-config.php or core WordPress files.
• Network: Unusual outbound connections from the WordPress server to unknown external hosts; unexpected administrative actions (plugin installs, user role changes) originating from unfamiliar IP addresses in WordPress admin logs.
• Process/Application: Unexpected new administrator-level user accounts in the WordPress user database (wp_users table with wp_capabilities set to administrator).

The primary remediation is to update the Directorist Social Login plugin to version 2.1.4 or later, which contains the fix for this vulnerability. If an immediate update is not possible, site administrators should consider temporarily deactivating the plugin and contacting their hosting provider for assistance. Patchstack users benefit from an automatic virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated (Patchstack). Administrators should also audit existing user accounts for any unauthorized privilege escalations.

Patchstack, which discovered and disclosed the vulnerability through researcher 0xd4rk5id3, classified it as high priority and noted its potential for use in mass-exploit campaigns targeting WordPress sites. The vulnerability was referenced in CISA's weekly vulnerability bulletin for the week of April 27, 2026, and covered by security aggregators including Wordfence's weekly WordPress vulnerability report (Patchstack).