myCred < 2.4.4 - Subscriber+ Import/Export to Email Address Disclosure
CVE-2022-1092

4.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Mycred
Vendor
CVE Published:
25 April 2022

Summary

The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog

Affected Version(s)

myCred 0 < 2.4.3.1

References

https://wpscan.com/vulnerability/95759d5c-8802-4493-b7e5-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

David Hamann
WPScan
.