Vulnerability · Published Jun 29, 2023 · Assigned by Wordfence

CVE-2023-3447Active Directory Integration / LDAP Integration <= 4.1.5 - Authenticated (Subscriber+) LDAP Injection

High 7.6

In plain English

A high-severity security flaw in Active Directory Integration / LDAP Integration from cyberlord92. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.5%top 55.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for attackers, with an existing account on a vulnerable WordPress instance, to extract potentially sensitive information from the LDAP directory.

Affected products (as reported)

Vendor	Product	Versions
cyberlord92	Active Directory Integration / LDAP Integration	0 – through 4.1.5

Weakness: CWE-90 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

In plain English

Official description

Affected products (as reported)

References