CVE-2022-2373

The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing unauthenticated users to retrieve WordPress users details such as name and email address

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

1.86% chance of exploitation in the next 30 days, 78th percentile

Nuclei

medium · CWE-862

Published

2022-08-29

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6aa9aa0d-b447-4584-a07e-b8a0d1b83a31

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2373.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-2372
• CVE-2022-23731
• CVE-2022-2371
• CVE-2022-2374
• CVE-2022-2370
• CVE-2022-2375