CVE-2022-43504 Information disclosure in WordPress
Remote attackers can obtain user email addresses via the Post by Email feature, requiring this feature to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-43504?
CVE-2022-43504 is a medium-severity vulnerability in Wordpress Wordpress, published on 5 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.
Weakness: CWE-287
Which versions are affected by CVE-2022-43504?
2 open source packages ship an affected version, including wordpress and wordpress-multisite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wordpress Bitnami | All versions | 3.7.40, 3.8.40, 3.9.39, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3 |
wordpress-multisite Bitnami | All versions | 3.7.40, 3.8.40, 3.9.39, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3 |
Products include Wordpress Wordpress.
How do I fix CVE-2022-43504?
Upgrade wordpress to a fixed version for your release line: 3.7.40, 3.8.40, 3.9.39 or 4.0.37.
Is CVE-2022-43504 being exploited?
There is no known exploitation of CVE-2022-43504 in the wild and no public exploit code.
Other vulnerabilities in Wordpress Wordpress
Sources
Also known as BIT-wordpress-2022-43504, BIT-wordpress-multisite-2022-43504, DEBIAN-CVE-2022-43504, GHSA-h8vf-v4qw-mvq4, UBUNTU-CVE-2022-43504.