Skip to content
Fencer Vulns
critical 9.8

CVE-2022-0679 in the critical feed json

Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE

published 2022-03-28 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-15764

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
47.8%
EPSS 47.8% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known, plus a Nuclei check

Summary

The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as the content of the file is then displayed in the response as JSON data. This could also lead to RCE with various tricks but depends on the underlying system and it's configuration.

Exploit prediction

47.83% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion nuclei detection template
  • wpscan.com https://wpscan.com/vulnerability/0ea79eb1-6561-4c21-a20b-a1870863b0a8 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • Unknown Narnoo Distributor

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.