CVE-2023-0812: Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data Disclosure

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-05-15 · updated 2026-06-17

Description

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.

Affected products

cyberlord92 Active Directory Integration / LDAP Integration: before 4.1.1 — fixed in 4.1.1

How to fix

Upgrade to a fixed version: cyberlord92 Active Directory Integration / LDAP Integration 4.1.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/0ed5e1b3-f2a3-4eb1-b8ae-d3a62f600107
https://wpscan.com/vulnerability/0ed5e1b3-f2a3-4eb1-b8ae-d3a62f600107

Get alerted when CVE-2023-0812 or the next vulnerability affects your stack