Improper authentication vulnerability in WordPress versions… (CVE-2022-43504)

Original description

The description as published by the source.

Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami wordpress-multisite

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.40"},{"introduced":"3.8.0"},{"fixed":"3.8.40"},{"introduced":"3.9.0"},{"fixed":"3.9.39"},{"introduced":"4.0.0"},{"fixed":"4.0.37"},{"introduced":"4.1.0"},{"fixed":"4.1.37"},{"introduced":"4.2.0"},{"fixed":"4.2.34"},{"introduced":"4.3.0"},{"fixed":"4.3.30"},{"introduced":"4.4.0"},{"fixed":"4.4.29"},{"introduced":"4.5.0"},{"fixed":"4.5.28"},{"introduced":"4.6.0"},{"fixed":"4.6.25"},{"introduced":"4.7.0"},{"fixed":"4.7.25"},{"introduced":"4.8.0"},{"fixed":"4.8.21"},{"introduced":"4.9.0"},{"fixed":"4.9.22"},{"introduced":"5.0.0"},{"fixed":"5.0.18"},{"introduced":"5.1.0"},{"fixed":"5.1.15"},{"introduced":"5.2.0"},{"fixed":"5.2.17"},{"introduced":"5.3.0"},{"fixed":"5.3.14"},{"introduced":"5.4.0"},{"fixed":"5.4.12"},{"introduced":"5.5.0"},{"fixed":"5.5.11"},{"introduced":"5.6.0"},{"fixed":"5.6.10"},{"introduced":"5.7.0"},{"fixed":"5.7.8"},{"introduced":"5.8.0"},{"fixed":"5.8.6"},{"introduced":"5.9.0"},{"fixed":"5.9.5"},{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}]

Bitnami wordpress

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.40"},{"introduced":"3.8.0"},{"fixed":"3.8.40"},{"introduced":"3.9.0"},{"fixed":"3.9.39"},{"introduced":"4.0.0"},{"fixed":"4.0.37"},{"introduced":"4.1.0"},{"fixed":"4.1.37"},{"introduced":"4.2.0"},{"fixed":"4.2.34"},{"introduced":"4.3.0"},{"fixed":"4.3.30"},{"introduced":"4.4.0"},{"fixed":"4.4.29"},{"introduced":"4.5.0"},{"fixed":"4.5.28"},{"introduced":"4.6.0"},{"fixed":"4.6.25"},{"introduced":"4.7.0"},{"fixed":"4.7.25"},{"introduced":"4.8.0"},{"fixed":"4.8.21"},{"introduced":"4.9.0"},{"fixed":"4.9.22"},{"introduced":"5.0.0"},{"fixed":"5.0.18"},{"introduced":"5.1.0"},{"fixed":"5.1.15"},{"introduced":"5.2.0"},{"fixed":"5.2.17"},{"introduced":"5.3.0"},{"fixed":"5.3.14"},{"introduced":"5.4.0"},{"fixed":"5.4.12"},{"introduced":"5.5.0"},{"fixed":"5.5.11"},{"introduced":"5.6.0"},{"fixed":"5.6.10"},{"introduced":"5.7.0"},{"fixed":"5.7.8"},{"introduced":"5.8.0"},{"fixed":"5.8.6"},{"introduced":"5.9.0"},{"fixed":"5.9.5"},{"introduced":"6.0.0"},{"fixed":"6.0.3"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2022-43504 wordpress Fixed in: 5.7.8+dfsg1-0+deb11u1
Ubuntu UBUNTU-CVE-2022-43504 wordpress

References

advisory nvd.nist.gov
advisory github.com
web jvn.jp
web wordpress.org
web wordpress.org