title: Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR
description: The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password  of arbitrary users instead of his own.
problem types: CWE-639 Authorization Bypass Through User-Controlled Key
affected:
{
vendor: Unknown
product: Directorist
collectionURL: https://wordpress.org/plugins
versions:
status: affected, versionType: custom, version: 0, lessThan: 7.4.2.2
defaultStatus: unaffected
}