What’s Vulnerable › Vulnerabilities

CVE-2022-4417: WP Cerber < 9.3.3 - User Enumeration Bypass via Rest API

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-02 · updated 2026-06-17

Description

The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users

Affected products

• gioni WP Cerber Security, Anti-spam & Malware Scan: before 9.3.3 — fixed in 9.3.3

How to fix

Upgrade to a fixed version: gioni WP Cerber Security, Anti-spam & Malware Scan 9.3.3. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/a8c6b077-ff93-4c7b-970f-3be4d7971aa5
• https://wpscan.com/vulnerability/a8c6b077-ff93-4c7b-970f-3be4d7971aa5

Get alerted when CVE-2022-4417 or the next vulnerability affects your stack