Skip to content
Fencer Vulns
medium 5.3

CVE-2022-43504 json

Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email add…

published 2022-12-05 3 y ago modified 2026-09-08 2 mo ago also BIT-wordpress-2022-43504 , BIT-wordpress-multisite-2022-43504 , EUVD-2022-46502

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.

Patch / fix

  • bitnami wordpress 3.7.40, 3.8.40, 3.9.39, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3
  • bitnami wordpress-multisite 3.7.40, 3.8.40, 3.9.39, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3
  • wordpress wordpress 3.7.40, 3.8.40, 3.9.39, 4.0.37, 4.1.37, 4.2.34, 4.3.30, 4.4.29, 4.5.28, 4.6.25, 4.7.25, 4.8.21, 4.9.22, 5.0.18, 5.1.15, 5.2.17, 5.3.14, 5.4.12, 5.5.11, 5.6.10
  • wordpress Debian 14, Debian 13, Debian 12 6.0.3+dfsg1-1

debian advisories DEBIAN-CVE-2022-43504

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-43504 updated cvss 5.3

wordpress: Improper authentication vulnerability allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.50% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
OSV 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
bitnami wordpress
<3.7.40
>=3.8.0, <3.8.40
>=3.9.0, <3.9.39
>=4.0.0, <4.0.37
>=4.1.0, <4.1.37
>=4.2.0, <4.2.34
>=4.3.0, <4.3.30
>=4.4.0, <4.4.29
>=4.5.0, <4.5.28
>=4.6.0, <4.6.25
>=4.7.0, <4.7.25
>=4.8.0, <4.8.21
>=4.9.0, <4.9.22
>=5.0.0, <5.0.18
>=5.1.0, <5.1.15
>=5.2.0, <5.2.17
>=5.3.0, <5.3.14
>=5.4.0, <5.4.12
>=5.5.0, <5.5.11
>=5.6.0, <5.6.10
>=5.7.0, <5.7.8
>=5.8.0, <5.8.6
>=5.9.0, <5.9.5
>=6.0.0, <6.0.3
3.7.40
3.8.40
3.9.39
4.0.37
4.1.37
4.2.34
4.3.30
4.4.29
4.5.28
4.6.25
4.7.25
4.8.21
4.9.22
5.0.18
5.1.15
5.2.17
5.3.14
5.4.12
5.5.11
5.6.10
5.7.8
5.8.6
5.9.5
6.0.3
bitnami wordpress-multisite
<3.7.40
>=3.8.0, <3.8.40
>=3.9.0, <3.9.39
>=4.0.0, <4.0.37
>=4.1.0, <4.1.37
>=4.2.0, <4.2.34
>=4.3.0, <4.3.30
>=4.4.0, <4.4.29
>=4.5.0, <4.5.28
>=4.6.0, <4.6.25
>=4.7.0, <4.7.25
>=4.8.0, <4.8.21
>=4.9.0, <4.9.22
>=5.0.0, <5.0.18
>=5.1.0, <5.1.15
>=5.2.0, <5.2.17
>=5.3.0, <5.3.14
>=5.4.0, <5.4.12
>=5.5.0, <5.5.11
>=5.6.0, <5.6.10
>=5.7.0, <5.7.8
>=5.8.0, <5.8.6
>=5.9.0, <5.9.5
>=6.0.0, <6.0.3
3.7.40
3.8.40
3.9.39
4.0.37
4.1.37
4.2.34
4.3.30
4.4.29
4.5.28
4.6.25
4.7.25
4.8.21
4.9.22
5.0.18
5.1.15
5.2.17
5.3.14
5.4.12
5.5.11
5.6.10
5.7.8
5.8.6
5.9.5
6.0.3

Affected products

  • WordPress.org WordPress

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.