Vulnerability · Published Sep 26, 2022 · Assigned by WPScan
CVE-2022-2987Ldap WP Login / Active Directory Integration < 3.0.2 - Unauthenticated Settings Update to Auth Bypass
High 7.5
In plain English
A high-severity missing authorization in Ldap WP Login / Active Directory Integration from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers to update them. Attackers could set their own LDAP server to be used to authenticated users, therefore bypassing the current authentication
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Ldap WP Login / Active Directory Integration | 3.0.2 – before 3.0.2 |
Weakness: CWE-862, CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N