CVE-2022-0287: falha em myCred
Mycred < 2.4.4.1 - Subscriber+ User E-mail Addresses Disclosure
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.8%
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog
Produtos afetados
Unknown · myCredCVEs relacionadas — myCred
No mesmo produto, das mais perigosas para as menos.
CVE-2022-1092—myCred < 2.4.4 - Subscriber+ Import/Export to Email Address DisclosureEPSS 0.4%CVE-2022-0363—myCred < 2.4.4 - Subscriber+ Arbitrary Post CreationEPSS 0.3%CVE-2026-15150MEDIUMmyCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCREDEPSS 0.2%