CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
What the vulnerability does
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for attackers, with an existing account on a vulnerable WordPress instance, to extract potentially sensitive information from the LDAP directory.
Explanation of Vulnerability in Simple Terms
Active Directory Integration / LDAP Integration versions up to 4.1.5 contain an LDAP injection vulnerability. An attacker with low-level access can inject malicious LDAP queries to read or modify directory data. The vulnerability affects confidentiality and integrity of user and system information stored in the directory service.
What an attacker can do
Inject malicious LDAP queries to read or modify Active Directory/LDAP data without proper authorization.
Potential impact on your site
User credentials, group memberships, and other directory data may be exposed or altered by authenticated attackers.
Conditions required to exploit
Attacker must have low-level user account access to the application.
Key dates
External resources
