The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published: 2022-02-28T09:06:47
Updated: 2024-08-02T23:25:40.513Z
Reserved: 2022-01-24T00:00:00
Link: CVE-2022-0345
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-02-28T09:15:08.997
Modified: 2023-11-07T03:41:12.987
Link: CVE-2022-0345
Redhat
No data.