CVE-2022-43504

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-43504", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "dateUpdated": "2025-04-24T14:04:17.689Z", "dateReserved": "2022-10-22T00:00:00.000Z", "datePublished": "2022-12-05T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-02-02T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7."}], "affected": [{"vendor": "WordPress.org", "product": "WordPress", "versions": [{"version": "versions prior to 6.0.3", "status": "affected"}]}], "references": [{"url": "https://wordpress.org/download/"}, {"url": "https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/"}, {"url": "https://jvn.jp/en/jp/JVN09409909/index.html"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Improper authentication"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:32:59.652Z"}, "title": "CVE Program Container", "references": [{"url": "https://wordpress.org/download/", "tags": ["x_transferred"]}, {"url": "https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN09409909/index.html", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-24T14:04:12.331568Z", "id": "CVE-2022-43504", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-24T14:04:17.689Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wordpress.org/download/", "tags": ["x_transferred"]}, {"url": "https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN09409909/index.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:32:59.652Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-43504", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-24T14:04:12.331568Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-24T14:04:06.594Z"}}], "cna": {"affected": [{"vendor": "WordPress.org", "product": "WordPress", "versions": [{"status": "affected", "version": "versions prior to 6.0.3"}]}], "references": [{"url": "https://wordpress.org/download/"}, {"url": "https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/"}, {"url": "https://jvn.jp/en/jp/JVN09409909/index.html"}], "descriptions": [{"lang": "en", "value": "Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Improper authentication"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-02-02T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-43504", "state": "PUBLISHED", "dateUpdated": "2025-04-24T14:04:17.689Z", "dateReserved": "2022-10-22T00:00:00.000Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2022-12-05T00:00:00.000Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "WordPress", "vendor": "WordPress.org", "versions": [{"status": "affected", "version": "versions prior to 6.0.3"}]}], "source": "vultures@jpcert.or.jp"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "5F6880E4-33A9-4662-8154-8906045D4BDB", "versionEndExcluding": "3.7.40", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6365CED-6940-4570-A833-E346D5D03301", "versionEndExcluding": "3.8.40", "versionStartIncluding": "3.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DC78C88-0F4D-46E2-BEAE-2590B6597110", "versionEndExcluding": "3.9.39", "versionStartIncluding": "3.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "9690E580-70FA-49D4-91CB-118DBFD0C772", "versionEndExcluding": "4.0.37", "versionStartIncluding": "4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "DDF4FA05-6B4C-4B84-B287-5206F976383C", "versionEndExcluding": "4.1.37", "versionStartIncluding": "4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "6FB506F8-0A9A-466B-A9BA-27E9E16DF60A", "versionEndExcluding": "4.2.34", "versionStartIncluding": "4.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "02BFC3E6-0C04-4D93-AF21-9E28F6517698", "versionEndExcluding": "4.3.30", "versionStartIncluding": "4.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "682611C5-D61E-4419-8118-CD22DF94587B", "versionEndExcluding": "4.4.29", "versionStartIncluding": "4.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACA0694E-78EE-461C-AF6C-2992A48FACC3", "versionEndExcluding": "4.5.28", "versionStartIncluding": "4.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "2A35E5D1-F72A-4979-8009-AB2FD2DF50AA", "versionEndExcluding": "4.6.25", "versionStartIncluding": "4.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E49C495-D666-4946-9756-80157FE8D46E", "versionEndExcluding": "4.7.25", "versionStartIncluding": "4.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD185AE4-EADD-4A15-BB02-D64C3570212A", "versionEndExcluding": "4.8.21", "versionStartIncluding": "4.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF4E5ED6-7005-44C1-8027-D516FFD06CD1", "versionEndExcluding": "4.9.22", "versionStartIncluding": "4.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "F6924C94-4641-4FF9-B224-E5FDDED36A28", "versionEndExcluding": "5.0.18", "versionStartIncluding": "5.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D5CA8ED-6422-4E21-8D9F-944B317AA90B", "versionEndExcluding": "5.1.15", "versionStartIncluding": "5.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "59157ECE-7741-483E-B134-17A211255541", "versionEndExcluding": "5.2.17", "versionStartIncluding": "5.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "83F27771-E690-463B-B0BE-467C68785879", "versionEndExcluding": "5.3.14", "versionStartIncluding": "5.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "3727394A-83E2-4536-B14D-779A0AED05C1", "versionEndExcluding": "5.4.12", "versionStartIncluding": "5.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7A11F6D-E9BD-4D06-A459-EAC1D00943ED", "versionEndExcluding": "5.5.11", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FB1EB9F-66E8-4100-B00C-1627677A4721", "versionEndExcluding": "5.6.10", "versionStartIncluding": "5.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "ACAA8CC7-B363-465A-ABFD-90BC3BA03C1E", "versionEndExcluding": "5.7.8", "versionStartIncluding": "5.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "F438ADFF-5BCA-4CEC-B3C8-38DD41CB68D9", "versionEndExcluding": "5.8.6", "versionStartIncluding": "5.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "BEA67D29-3629-4162-9177-387A49B08EC7", "versionEndExcluding": "5.9.5", "versionStartIncluding": "5.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "matchCriteriaId": "82A446E4-E097-4D7C-9972-4B35B9D4F048", "versionEndExcluding": "6.0.3", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7."}, {"lang": "es", "value": "Una vulnerabilidad de autenticaci\u00f3n inadecuada en las versiones de WordPress anteriores a la 6.0.3 permite que un atacante remoto no autenticado obtenga la direcci\u00f3n de correo electr\u00f3nico del usuario que public\u00f3 un blog utilizando WordPress Post by Email Feature. El desarrollador tambi\u00e9n proporciona nuevas versiones parcheadas para todas las versiones desde la 3.7."}], "id": "CVE-2022-43504", "lastModified": "2026-06-17T05:06:40.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-43504", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-24T14:04:12.331568Z", "version": "2.0.3"}}]}, "published": "2022-12-05T04:15:10.610", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN09409909/index.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Product", "Vendor Advisory"], "url": "https://wordpress.org/download/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Patch", "Release Notes", "Vendor Advisory"], "url": "https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN09409909/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Vendor Advisory"], "url": "https://wordpress.org/download/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Release Notes", "Vendor Advisory"], "url": "https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-287"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}