CVE-2022-0287
EUVD-2022-1545825.04.2022, 16:16
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blogEnginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| wpexperts | mycred | 𝑥 < 2.4.4.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration