CVE-2022-44581 WordPress Defender Security plugin <= 3.3.2 - Broken Authentication vulnerability

Q: What is CVE-2022-44581?

CVE-2022-44581 is a medium-severity vulnerability in WPMU DEV Defender Security, published on 17 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Q: Is CVE-2022-44581 being exploited?

There is no known exploitation of CVE-2022-44581 in the wild and no public exploit code.

Q: How do I fix CVE-2022-44581?

No fix has been published for CVE-2022-44581 yet. Limit exposure of the affected software until one is available.

Medium 5.0 Published 17 May 2024 Updated 28 Apr 2026

Attackers can access sensitive information stored in temporary files within the WordPress Defender Security plugin.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-44581?

CVE-2022-44581 is a medium-severity vulnerability in WPMU DEV Defender Security, published on 17 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Insecure Storage of Sensitive Information vulnerability in WPMU DEV Defender Security allows : Screen Temporary Files for Sensitive Information.This issue affects Defender Security: from n/a through 3.3.2.

Weakness: CWE-922

Which versions are affected by CVE-2022-44581?

It affects 1 product.

Products include Wpmudev Defender.

How do I fix CVE-2022-44581?

No fix has been published for CVE-2022-44581 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-44581 being exploited?

There is no known exploitation of CVE-2022-44581 in the wild and no public exploit code.

Sources

Also known as GHSA-7p4c-4hvh-3rq2.