7.5

CVE-2023-5003: miniorange active_directory_integration_\/_ldap_integration

CVSS: 7.5v3.1HighModified
AliasesopenSUSE-SU-2025:14717-1
Published 16-10-2023Last modified 23-04-2025
Open JSON

Vulnerability summary

CVE-2023-5003 is a high (CVSS 7.5) vulnerability in miniorange active_directory_integration_\/_ldap_integration. EPSS estimates a 26.63% chance of exploitation in the next 30 days, higher than 98% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
45/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
26.63%
0%100%
High · +0.78 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 16-10-2023
    PublishedVulnerability first disclosed.
  2. 23-04-2025
    Last modifiedVulnerability information updated.

Description

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

26.63%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

+0.78 pp

From 25.86% on 21-09-2026

21-09-202621-10-2026
EPSS score
26.63%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (wpscan.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Miniorange1 product
Opensuse1 product
  • owasp-modsecurity-crs&distro=openSUSE Tumbleweed< 4.10.0-1.1
Unknown1 product
Wordpress1 product
  • ldap-login-for-intranet-sites≤ 4.1.9 (fixed in 4.1.10)

4 vendors · 4 products

References

4 links