Technical impact
The WP Directorybox Manager plugin contains a flaw in the wp_dp_enquiry_agent_contact_form_submit_callback function that allows an attacker to authenticate as any existing user by simply supplying a valid username. This weakness enables unauthorized access to site accounts and any privileges associated with them, including administrator rights if the target username is known. The vulnerability is a classic Authentication Bypass (CWE-288) and can lead to full control of the WordPress installation.
Affected Systems
The issue affects the Chimpstudio WP Directorybox Manager plugin for WordPress, version 2.5 and earlier. Site owners using any of these versions are at risk.
Risk and Exploitability
The CVSS v3.1 score of 9.8 indicates Critical severity. The EPSS score of less than 1% suggests current exploitation probability is low but not zero, so the threat is present but uncommon. The vulnerability is not listed in the CISA KEV catalog. Attacks would most likely originate from remote clients that can submit the vulnerable contact form, four steps: reach the form endpoint, provide a known username, trigger the callback, and obtain a valid authentication cookie. No special privileges or network access are required beyond being able to send an HTTP request.
EUVD