CVE-2023-3447
published 2023-06-29CVE-2023-3447: The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.53%
40.9th percentile
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for attackers, with an existing account on a vulnerable WordPress instance, to extract potentially sensitive information from the LDAP directory.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cyberlord92 | active_directory_integration_ldap_integration | <= 4.1.5 | — |
| miniorange | active_directory_integration_ldap_integration | < 4.1.6 | 4.1.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Active Directory Integration & LDAP Integration Plugin ldap injection
vuldb·2026-04-10·CVSS 7.6
CVE-2023-3447 [HIGH] Active Directory Integration & LDAP Integration Plugin ldap injection
A vulnerability was found in Active Directory Integration & LDAP Integration Plugin up to 4.1.5 on WordPress. It has been classified as critical. This issue affects some unknown processing. The manipulation of the argument Username leads to ldap injection.
This vulnerability is listed as CVE-2023-3447. The attack may be initiated remotely. There is no available exploit.
GHSA
GHSA-wxg4-73q7-87rm: The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4
ghsa_unreviewed·2023-06-29
CVE-2023-3447 [HIGH] CWE-90 GHSA-wxg4-73q7-87rm: The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for unauthenticated attackers to extract potentially sensitive information from the LDAP directory.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2928150%40ldap-login-for-intranet-sites&new=2928150%40ldap-login-for-intranet-sites&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7553e8-e43d-4740-b2ee-e3d8dc351e53?source=cvehttps://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2928150%40ldap-login-for-intranet-sites&new=2928150%40ldap-login-for-intranet-sites&sfp_email=&sfph_mail=https://www.wordfence.com/threat-intel/vulnerabilities/id/cd7553e8-e43d-4740-b2ee-e3d8dc351e53?source=cve
2023-06-29
Published