VulnerabilityModified
CVE-2022-4417
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
MEDIUM 5.3EPSS 0.67%
Does this matter?
Lower severity and a low EPSS score (0.67%). Track it; it rarely justifies an emergency change on its own.
Description
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.67% probability · 50th percentile
- CISA KEV
- Not listed
- Affected
- cerber/wp cerber security\, anti-spam \& malware scan
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/a8c6b077-ff93-4c7b-970f-3be4d7971aa5Exploit, Vendor Advisory
- https://wpscan.com/vulnerability/a8c6b077-ff93-4c7b-970f-3be4d7971aa5Exploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.