CVE-2022-0679: Narnoo Distributor WordPress plugin path traversal in lib_path parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code, and high EPSS make this an urgent risk for any site running the affected plugin.

What it is

The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before passing it to require() via the narnoo_distributor_lib_request AJAX action. This allows arbitrary file disclosure, with file contents returned as JSON, and may lead to remote code execution depending on the underlying system and configuration.

Impact

An attacker can read arbitrary files from the server, exposing sensitive data such as configuration and credential files. Under certain system configurations, the flaw could be chained to achieve remote code execution.

Attack surface

The vulnerable AJAX action is reachable over the network and is available to both unauthenticated and authenticated users, requiring no user interaction. The lib_path parameter is supplied directly in the request.

Exploitation

No CISA KEV listing is present, but EPSS is 0.4783 (98.8th percentile) and the WPScan reference is tagged Exploit, indicating public exploit code exists and exploitation is likely.

What to do

• Update the Narnoo Distributor plugin beyond version 2.5.1 or remove it if no fixed version is available.
• Restrict or disable the narnoo_distributor_lib_request AJAX action if the plugin cannot be patched immediately.
• Apply a web application firewall rule to block path traversal sequences in the lib_path parameter.
• Run WordPress with least privilege and restrict file permissions to limit the impact of arbitrary file reads.
• Monitor plugin vendor channels for a patched release and apply it as soon as it is published.

Detection

• Search web server and WordPress logs for requests to admin-ajax.php with action=narnoo_distributor_lib_request and traversal sequences in lib_path.
• Alert on AJAX requests containing lib_path values with ../ or absolute paths.
• Monitor for unusual JSON responses containing file contents from sensitive paths such as wp-config.php.
• Review file access logs for reads of configuration or credential files by the web server user.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.