The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for attackers, with an existing account on a vulnerable WordPress instance, to extract potentially sensitive information from the LDAP directory.
References
Configurations
Configuration 1 (hide)
|
History
08 Apr 2026, 19:18
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-90 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.6 |
| Summary | (en) The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for attackers, with an existing account on a vulnerable WordPress instance, to extract potentially sensitive information from the LDAP directory. |
21 Nov 2024, 08:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.6 |
| References | () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2928150%40ldap-login-for-intranet-sites&new=2928150%40ldap-login-for-intranet-sites&sfp_email=&sfph_mail= - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7553e8-e43d-4740-b2ee-e3d8dc351e53?source=cve - Third Party Advisory |
07 Nov 2023, 04:18
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
07 Jul 2023, 16:02
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7553e8-e43d-4740-b2ee-e3d8dc351e53?source=cve - Third Party Advisory | |
| References | (MISC) https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2928150%40ldap-login-for-intranet-sites&new=2928150%40ldap-login-for-intranet-sites&sfp_email=&sfph_mail= - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| First Time |
Miniorange
Miniorange active Directory Integration \/ Ldap Integration |
|
| CPE | cpe:2.3:a:miniorange:active_directory_integration_\/_ldap_integration:*:*:*:*:*:wordpress:*:* |
29 Jun 2023, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-29 05:15
Updated : 2026-04-08 19:18
NVD link : CVE-2023-3447
Mitre link : CVE-2023-3447
CVE.ORG link : CVE-2023-3447
JSON object : View
Products Affected
miniorange
- active_directory_integration_\/_ldap_integration
CWE
CWE-90
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')