WordPress core

CVE-2022-43504

Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who posted a blog using the WordPress Post by Email Feature. The developer also provides new patched releases for all versions since 3.7.

Severity: Medium 5.3
Published: 5 Dec 2022
Last changed: 17 Jun 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 5.5.11, 5.6.10, 5.7.8, 5.8.6, 5.9.5, 6.0.3
Sources: NVD

Affected software

Software Affected versions

Software	Affected versions
WordPressWordPress core · `cpe:a:wordpress:wordpress`	From 6.0 before 6.0.3 From 5.9 before 5.9.5 From 5.8 before 5.8.6 From 5.7 before 5.7.8 All 24 release lines Every version before 3.7.40 From 3.8 before 3.8.40 From 3.9 before 3.9.39 From 4.0 before 4.0.37 From 4.1 before 4.1.37 From 4.2 before 4.2.34 From 4.3 before 4.3.30 From 4.4 before 4.4.29 From 4.5 before 4.5.28 From 4.6 before 4.6.25 From 4.7 before 4.7.25 From 4.8 before 4.8.21 From 4.9 before 4.9.22 From 5.0 before 5.0.18 From 5.1 before 5.1.15 From 5.2 before 5.2.17 From 5.3 before 5.3.14 From 5.4 before 5.4.12 From 5.5 before 5.5.11 From 5.6 before 5.6.10 From 5.7 before 5.7.8 From 5.8 before 5.8.6 From 5.9 before 5.9.5 From 6.0 before 6.0.3

WordPressWordPress core · cpe:a:wordpress:wordpress

From 6.0 before 6.0.3
From 5.9 before 5.9.5
From 5.8 before 5.8.6
From 5.7 before 5.7.8

All 24 release lines

Every version before 3.7.40
From 3.8 before 3.8.40
From 3.9 before 3.9.39
From 4.0 before 4.0.37
From 4.1 before 4.1.37
From 4.2 before 4.2.34
From 4.3 before 4.3.30
From 4.4 before 4.4.29
From 4.5 before 4.5.28
From 4.6 before 4.6.25
From 4.7 before 4.7.25
From 4.8 before 4.8.21
From 4.9 before 4.9.22
From 5.0 before 5.0.18
From 5.1 before 5.1.15
From 5.2 before 5.2.17
From 5.3 before 5.3.14
From 5.4 before 5.4.12
From 5.5 before 5.5.11
From 5.6 before 5.6.10
From 5.7 before 5.7.8
From 5.8 before 5.8.6
From 5.9 before 5.9.5
From 6.0 before 6.0.3

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2022-43504
CVE.org https://www.cve.org/CVERecord?id=CVE-2022-43504