CVE-2022-1092

myCred < 2.4.4 - Subscriber+ Import/Export to Email Address Disclosure

published April 25, 2022

CVSS
—
EPSS
0%
Percentile
36.1
In the wild
Unconfirmed
What it is

The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00429 · 36.1th percentile
Published
2022-04-25T15:51Z
EPSS history
Timeline
  • 25 APR 15:51Z
    myCred < 2.4.4 - Subscriber+ Import/Export to Email Address Disclosure
    cvelistv5