CVE-2022-43504

Estado: ModificadaMedia (5.3)—
Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.
CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Puntuación base: 5.3
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.50%
Percentil entre todas las CVEs puntuadas: 73
Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)

Wordpress — Wordpress
CWE

CWE-287
CWE-287
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-43504",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-43504",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-24T14:04:12.331568Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "WordPress.org",
          "product": "WordPress",
          "versions": [
            {
              "status": "affected",
              "version": "versions prior to 6.0.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-12-05T04:15:10.610",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN09409909/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://wordpress.org/download/",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN09409909/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/download/",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de autenticación inadecuada en las versiones de WordPress anteriores a la 6.0.3 permite que un atacante remoto no autenticado obtenga la dirección de correo electrónico del usuario que publicó un blog utilizando WordPress Post by Email Feature. El desarrollador también proporciona nuevas versiones parcheadas para todas las versiones desde la 3.7."
    }
  ],
  "lastModified": "2026-06-17T05:06:40.977",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F6880E4-33A9-4662-8154-8906045D4BDB",
              "versionEndExcluding": "3.7.40"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6365CED-6940-4570-A833-E346D5D03301",
              "versionEndExcluding": "3.8.40",
              "versionStartIncluding": "3.8"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DC78C88-0F4D-46E2-BEAE-2590B6597110",
              "versionEndExcluding": "3.9.39",
              "versionStartIncluding": "3.9"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9690E580-70FA-49D4-91CB-118DBFD0C772",
              "versionEndExcluding": "4.0.37",
              "versionStartIncluding": "4.0"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDF4FA05-6B4C-4B84-B287-5206F976383C",
              "versionEndExcluding": "4.1.37",
              "versionStartIncluding": "4.1"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6FB506F8-0A9A-466B-A9BA-27E9E16DF60A",
              "versionEndExcluding": "4.2.34",
              "versionStartIncluding": "4.2"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02BFC3E6-0C04-4D93-AF21-9E28F6517698",
              "versionEndExcluding": "4.3.30",
              "versionStartIncluding": "4.3"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "682611C5-D61E-4419-8118-CD22DF94587B",
              "versionEndExcluding": "4.4.29",
              "versionStartIncluding": "4.4"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACA0694E-78EE-461C-AF6C-2992A48FACC3",
              "versionEndExcluding": "4.5.28",
              "versionStartIncluding": "4.5"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A35E5D1-F72A-4979-8009-AB2FD2DF50AA",
              "versionEndExcluding": "4.6.25",
              "versionStartIncluding": "4.6"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E49C495-D666-4946-9756-80157FE8D46E",
              "versionEndExcluding": "4.7.25",
              "versionStartIncluding": "4.7"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD185AE4-EADD-4A15-BB02-D64C3570212A",
              "versionEndExcluding": "4.8.21",
              "versionStartIncluding": "4.8"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF4E5ED6-7005-44C1-8027-D516FFD06CD1",
              "versionEndExcluding": "4.9.22",
              "versionStartIncluding": "4.9"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6924C94-4641-4FF9-B224-E5FDDED36A28",
              "versionEndExcluding": "5.0.18",
              "versionStartIncluding": "5.0"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D5CA8ED-6422-4E21-8D9F-944B317AA90B",
              "versionEndExcluding": "5.1.15",
              "versionStartIncluding": "5.1"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59157ECE-7741-483E-B134-17A211255541",
              "versionEndExcluding": "5.2.17",
              "versionStartIncluding": "5.2"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83F27771-E690-463B-B0BE-467C68785879",
              "versionEndExcluding": "5.3.14",
              "versionStartIncluding": "5.3"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3727394A-83E2-4536-B14D-779A0AED05C1",
              "versionEndExcluding": "5.4.12",
              "versionStartIncluding": "5.4"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7A11F6D-E9BD-4D06-A459-EAC1D00943ED",
              "versionEndExcluding": "5.5.11",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FB1EB9F-66E8-4100-B00C-1627677A4721",
              "versionEndExcluding": "5.6.10",
              "versionStartIncluding": "5.6"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACAA8CC7-B363-465A-ABFD-90BC3BA03C1E",
              "versionEndExcluding": "5.7.8",
              "versionStartIncluding": "5.7"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F438ADFF-5BCA-4CEC-B3C8-38DD41CB68D9",
              "versionEndExcluding": "5.8.6",
              "versionStartIncluding": "5.8"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEA67D29-3629-4162-9177-387A49B08EC7",
              "versionEndExcluding": "5.9.5",
              "versionStartIncluding": "5.9"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82A446E4-E097-4D7C-9972-4B35B9D4F048",
              "versionEndExcluding": "6.0.3",
              "versionStartIncluding": "6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}