CVE-2022-43504: WordPress

Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days.

Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.

Affected products

• WordPress WordPress: before 3.7.40 (fixed in 3.7.40); from 3.8, before 3.8.40 (fixed in 3.8.40); from 3.9, before 3.9.39 (fixed in 3.9.39); from 4.0, before 4.0.37 (fixed in 4.0.37); from 4.1, before 4.1.37 (fixed in 4.1.37); from 4.2, before 4.2.34 (fixed in 4.2.34); …

Published 2022-12-05. Last modified 2026-06-17.