CVE-2022-43504

Status: ModifiedMedium (5.3)—
Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.
CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base score: 5.3
Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 1.50%
Percentile among all scored CVEs: 73
Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)

Wordpress — Wordpress
CWEs

CWE-287
CWE-287
References

Raw JSON (NVD)

Show
{
  "id": "CVE-2022-43504",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-43504",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-24T14:04:12.331568Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "WordPress.org",
          "product": "WordPress",
          "versions": [
            {
              "status": "affected",
              "version": "versions prior to 6.0.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-12-05T04:15:10.610",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN09409909/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://wordpress.org/download/",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN09409909/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/download/",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de autenticación inadecuada en las versiones de WordPress anteriores a la 6.0.3 permite que un atacante remoto no autenticado obtenga la dirección de correo electrónico del usuario que publicó un blog utilizando WordPress Post by Email Feature. El desarrollador también proporciona nuevas versiones parcheadas para todas las versiones desde la 3.7."
    }
  ],
  "lastModified": "2026-06-17T05:06:40.977",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F6880E4-33A9-4662-8154-8906045D4BDB",
              "versionEndExcluding": "3.7.40"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6365CED-6940-4570-A833-E346D5D03301",
              "versionEndExcluding": "3.8.40",
              "versionStartIncluding": "3.8"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DC78C88-0F4D-46E2-BEAE-2590B6597110",
              "versionEndExcluding": "3.9.39",
              "versionStartIncluding": "3.9"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9690E580-70FA-49D4-91CB-118DBFD0C772",
              "versionEndExcluding": "4.0.37",
              "versionStartIncluding": "4.0"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDF4FA05-6B4C-4B84-B287-5206F976383C",
              "versionEndExcluding": "4.1.37",
              "versionStartIncluding": "4.1"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6FB506F8-0A9A-466B-A9BA-27E9E16DF60A",
              "versionEndExcluding": "4.2.34",
              "versionStartIncluding": "4.2"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02BFC3E6-0C04-4D93-AF21-9E28F6517698",
              "versionEndExcluding": "4.3.30",
              "versionStartIncluding": "4.3"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "682611C5-D61E-4419-8118-CD22DF94587B",
              "versionEndExcluding": "4.4.29",
              "versionStartIncluding": "4.4"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACA0694E-78EE-461C-AF6C-2992A48FACC3",
              "versionEndExcluding": "4.5.28",
              "versionStartIncluding": "4.5"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A35E5D1-F72A-4979-8009-AB2FD2DF50AA",
              "versionEndExcluding": "4.6.25",
              "versionStartIncluding": "4.6"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E49C495-D666-4946-9756-80157FE8D46E",
              "versionEndExcluding": "4.7.25",
              "versionStartIncluding": "4.7"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD185AE4-EADD-4A15-BB02-D64C3570212A",
              "versionEndExcluding": "4.8.21",
              "versionStartIncluding": "4.8"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF4E5ED6-7005-44C1-8027-D516FFD06CD1",
              "versionEndExcluding": "4.9.22",
              "versionStartIncluding": "4.9"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6924C94-4641-4FF9-B224-E5FDDED36A28",
              "versionEndExcluding": "5.0.18",
              "versionStartIncluding": "5.0"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D5CA8ED-6422-4E21-8D9F-944B317AA90B",
              "versionEndExcluding": "5.1.15",
              "versionStartIncluding": "5.1"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59157ECE-7741-483E-B134-17A211255541",
              "versionEndExcluding": "5.2.17",
              "versionStartIncluding": "5.2"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83F27771-E690-463B-B0BE-467C68785879",
              "versionEndExcluding": "5.3.14",
              "versionStartIncluding": "5.3"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3727394A-83E2-4536-B14D-779A0AED05C1",
              "versionEndExcluding": "5.4.12",
              "versionStartIncluding": "5.4"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7A11F6D-E9BD-4D06-A459-EAC1D00943ED",
              "versionEndExcluding": "5.5.11",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FB1EB9F-66E8-4100-B00C-1627677A4721",
              "versionEndExcluding": "5.6.10",
              "versionStartIncluding": "5.6"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACAA8CC7-B363-465A-ABFD-90BC3BA03C1E",
              "versionEndExcluding": "5.7.8",
              "versionStartIncluding": "5.7"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F438ADFF-5BCA-4CEC-B3C8-38DD41CB68D9",
              "versionEndExcluding": "5.8.6",
              "versionStartIncluding": "5.8"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEA67D29-3629-4162-9177-387A49B08EC7",
              "versionEndExcluding": "5.9.5",
              "versionStartIncluding": "5.9"
            },
            {
              "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82A446E4-E097-4D7C-9972-4B35B9D4F048",
              "versionEndExcluding": "6.0.3",
              "versionStartIncluding": "6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}