CVE-2022-43504: wordpress Improper Authentication
CVSS: 5.3v3.1MediumModified
AliasesUBUNTU-CVE-2022-43504DEBIAN-CVE-2022-43504
Published 05-12-2022Last modified 24-04-2025
Vulnerability summary
CVE-2022-43504 is a medium (CVSS 5.3) Improper Authentication vulnerability in wordpress. EPSS estimates a 1.50% chance of exploitation in the next 30 days, higher than 73.8% of scored vulnerabilities. Fixed in 3.7.40.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
1.50%
0%100%
Low · +0.06 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 05-12-2022PublishedVulnerability first disclosed.
- 24-04-2025Last modifiedVulnerability information updated.
Description
Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
1.50%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
+0.06 pp
From 1.44% on 19-09-2026
19-09-202619-10-2026
EPSS score1.50%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Wordpress2 products
- wordpress≤ 3.6.1 (fixed in 3.7.40) | ≥ 3.7, ≤ 3.7.39 (fixed in 3.7.40) | ≥ 3.8, ≤ 3.8.39 (fixed in 3.7.40) | ≥ 3.9, ≤ 3.9.37 (fixed in 3.7.40) | ≥ 4.0, ≤ 4.0.36 (fixed in 3.7.40) | ≥ 4.1, ≤ 4.1.36 (fixed in 3.7.40) | ≥ 4.2, ≤ 4.2.33 (fixed in 3.7.40) | ≥ 4.3, ≤ 4.3.29 (fixed in 3.7.40) | ≥ 4.4, ≤ 4.4.28 (fixed in 3.7.40) | ≥ 4.5, ≤ 4.5.27 (fixed in 3.7.40) | ≥ 4.6, ≤ 4.6.24 (fixed in 3.7.40) | ≥ 4.7, ≤ 4.7.24 (fixed in 3.7.40) | ≥ 4.8, ≤ 4.8.20 (fixed in 3.7.40) | ≥ 4.9, ≤ 4.9.21 (fixed in 3.7.40) | ≥ 5.0, ≤ 5.0.17 (fixed in 3.7.40) | ≥ 5.1, ≤ 5.1.14 (fixed in 3.7.40) | ≥ 5.2, ≤ 5.2.16 (fixed in 3.7.40) | ≥ 5.3, ≤ 5.3.13 (fixed in 3.7.40) | ≥ 5.4, ≤ 5.4.11 (fixed in 3.7.40) | ≥ 5.5, ≤ 5.5.10 (fixed in 3.7.40) | ≥ 5.6, ≤ 5.6.9 (fixed in 3.7.40) | ≥ 5.7, ≤ 5.7.7 (fixed in 3.7.40) | ≥ 5.8, ≤ 5.8.5 (fixed in 3.7.40) | ≥ 5.9, ≤ 5.9.4 (fixed in 3.7.40) | ≥ 6.0, ≤ 6.0.2 (fixed in 3.7.40)
- wordpress< 3.7.40 | ≥ 3.8, < 3.8.40 | ≥ 3.9, < 3.9.39 | ≥ 4.0, < 4.0.37 | ≥ 4.1, < 4.1.37 | ≥ 4.2, < 4.2.34 | ≥ 4.3, < 4.3.30 | ≥ 4.4, < 4.4.29 | ≥ 4.5, < 4.5.28 | ≥ 4.6, < 4.6.25 | ≥ 4.7, < 4.7.25 | ≥ 4.8, < 4.8.21 | ≥ 4.9, < 4.9.22 | ≥ 5.0, < 5.0.18 | ≥ 5.1, < 5.1.15 | ≥ 5.2, < 5.2.17 | ≥ 5.3, < 5.3.14 | ≥ 5.4, < 5.4.12 | ≥ 5.5, < 5.5.11 | ≥ 5.6, < 5.6.10 | ≥ 5.7, < 5.7.8 | ≥ 5.8, < 5.8.6 | ≥ 5.9, < 5.9.5 | ≥ 6.0, < 6.0.3
Debian1 product
- wordpress< 6.0.3+dfsg1-1
Ubuntu1 product
- wordpressAll versions (No fix recorded)
Wordpress.org1 product
- wordpressversions prior to 6.0.3
4 vendors · 5 products
