CVE-2022-34867 HIGH

CVE-2022-34867: WordPress WP Libre Form 2 plugin <= 2.0.8 - Unauthenticated Sensitive Information Disclosure vulnerability

Vendor Libreform

Product WP Libre Form 2 (WordPress plugin)

Weakness CWE-200 · Info exposure

Published September 6, 2022

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

7.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and delete submissions. Affects only versions from 2.0.0 to 2.0.8.

Explanation of Vulnerability in Simple Terms

02Summary

WP Libre Form 2 through version 2.0.8 exposes sensitive information to unauthenticated attackers over the network. The plugin fails to properly restrict access to data, allowing attackers to read and modify information without authentication. This affects all installations running the vulnerable version.

What an attacker can do

03Attacker Capabilities

Read and modify form data and other sensitive information without logging in.

Potential impact on your site

04Site Impact

Form submissions and other plugin data may be exposed to or modified by unauthorized visitors.

Conditions required to exploit

05Prerequisites

None. The attacker needs only network access to the WordPress site.

Key dates

06Disclosure timeline

September 6, 2022 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-34867 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html AskarLabs — CWE-200 write-up Exposure of Sensitive Information to an Unauthorized Actor

Related vulnerabilities

Identifiers

CVE CVE-2022-34867

CWE CWE-200

CVSS 7.3 / HIGH

Affected versions