WordPress Plugin Vulnerabilities

Active Directory Integration / LDAP Integration < 4.2 - Admin LDAP Passback

Description

The plugin does not properly validate input when changing the LDAP server. This can result in the ability for authenticated administrators to alter the LDAP server and access the credentials of the original LDAP server.

Affects Plugins

Plugin icon
ldap-login-for-intranet-sites
Fixed in 4.2

References

CVE
CVE-2023-4506
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0585969d-dd08-4058-9d72-138a55a2cdf1

Miscellaneous

Original Researcher
Pedro José Navas Pérez
Verified
No
WPVDB ID
2744b765-117f-4165-b0b7-b78f3b4ce89f

Timeline

Publicly Published
2023-09-25 (about 2 years ago)
Added
2023-09-26 (about 2 years ago)
Last Updated
2023-10-09 (about 2 years ago)

Other

Published
Title
Published
2025-02-26
Title
Jeg Elementor Kit < 2.6.12 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas
Published
2014-08-01
Title
vTiger - CRM Lead Capture Unspecified
Published
2015-05-15
Title
WP Backup Plus - Backup Disclosure
Published
2025-02-03
Title
Real Estate Manager – Property Listing and Agent Management <= 7.3 - CAPTCHA Bypass
Published
2021-11-25
Title
WordPress < 5.8 - Plugin Confusion