CVE-2022-0679

Medium PUBLISHED

Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE

Unknown · Narnoo Distributor

Not yet in CISA KEV

Exploited in the wild PoC available

Recommended Action

Treat as actively exploited. Assess exposure, apply compensating controls where patching is delayed, and monitor for abuse.

Confidence
Medium
Exploitation Status
Exploited in the wild
Observed in Sensors
No
Attempts (30d)
Unique Attacker IPs
CISA KEV
Not yet in CISA KEV
CVSS / EPSS
9.8 Critical

At a Glance

The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as the content of the file is then displayed in the response as JSON data. This could also lead to RCE with various tricks but depends on the underlying system and it's configuration.

nuclei_scanner
Published
Mar 28, 2022
First Seen
Sep 18, 2025
CVSS
9.8 Critical
EPSS
Remote Low complexity No user interaction Unauthenticated

Recommended Actions

  • Treat as actively exploited. Assess exposure, apply compensating controls where patching is delayed, and monitor for abuse.
  • Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
  • Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.